@modelcontextprotocol/inspector 2.2.0 → 2.4.0

package/clients/web/build/index.js

@@ -1,12 +1,11 @@
 #!/usr/bin/env node
-import "./chunk-MCKGQKYU.js";
 
 // src/index.ts
-import { resolve as resolve5 } from "path";
+import { resolve as resolve8 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 
 // server/run-web.ts
-import { resolve as resolve4, join as join9, dirname as dirname7 } from "path";
+import { resolve as resolve7, join as join10, dirname as dirname9 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command } from "commander";
 
@@ -116,6 +115,22 @@ var SECRET_FIELD_IDP_CLIENT_SECRET = "idp-client-secret";
 var envSecretField = (envKey) => `env:${envKey}`;
 
 // ../../core/json/jsonUtils.ts
+function isSerializableJson(value) {
+  if (value === null) return true;
+  switch (typeof value) {
+    case "string":
+    case "boolean":
+      return true;
+    case "number":
+      return Number.isFinite(value);
+    case "object":
+      return Array.isArray(value) ? value.every(isSerializableJson) : Object.values(value).every(
+        isSerializableJson
+      );
+    default:
+      return false;
+  }
+}
 function toRecord(value) {
   return value;
 }
@@ -180,6 +195,100 @@ function envPairsToRecord(pairs) {
   }
   return out;
 }
+function stdioConfigFieldsFromSettings(settings) {
+  const env = envPairsToRecord(settings.env);
+  const cwd = settings.cwd?.trim();
+  return {
+    env: Object.keys(env).length > 0 ? env : void 0,
+    cwd: cwd ? cwd : void 0
+  };
+}
+function normalizeStoredMetadata(metadata) {
+  if (metadata === void 0 || metadata === null) return {};
+  if (Array.isArray(metadata)) {
+    const out = {};
+    for (const entry of metadata) {
+      if (typeof entry !== "object" || entry === null || typeof entry.key !== "string") {
+        console.warn(
+          "Ignoring malformed legacy metadata entry (expected `{ key, value }`)."
+        );
+        continue;
+      }
+      const { key, value } = entry;
+      if (key.trim() === "") continue;
+      const resolved2 = value === void 0 ? "" : value;
+      if (!keepSerializable(key, resolved2)) continue;
+      defineMetadataKey(out, key, resolved2);
+    }
+    return out;
+  }
+  if (typeof metadata === "object") {
+    const out = {};
+    for (const [key, value] of Object.entries(metadata)) {
+      if (keepSerializable(key, value)) defineMetadataKey(out, key, value);
+    }
+    return out;
+  }
+  console.warn(
+    `Ignoring malformed \`metadata\` (expected a JSON object, got ${describeJsonType(metadata)}).`
+  );
+  return {};
+}
+function defineMetadataKey(out, key, value) {
+  Object.defineProperty(out, key, {
+    value,
+    writable: true,
+    enumerable: true,
+    configurable: true
+  });
+}
+function keepSerializable(key, value) {
+  if (isSerializableJson(value)) return true;
+  console.warn(
+    `Ignoring metadata key "${key}" \u2014 its value is not JSON that can be sent (got ${describeJsonType(value)}; note \`1e400\` parses to Infinity).`
+  );
+  return false;
+}
+function describeJsonType(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  if (typeof value === "number" && !Number.isFinite(value)) {
+    return Number.isNaN(value) ? "NaN" : "a non-finite number";
+  }
+  return typeof value;
+}
+function cleanAuthorizationParams(params) {
+  if (params === void 0) return void 0;
+  if (typeof params !== "object" || params === null || Array.isArray(params)) {
+    console.warn(
+      "Ignoring `oauth.authorizationParams`: expected an object of string values, got",
+      Array.isArray(params) ? "array" : typeof params
+    );
+    return void 0;
+  }
+  const out = {};
+  for (const [key, value] of Object.entries(params)) {
+    if (typeof value !== "string") {
+      console.warn(
+        `Dropping \`oauth.authorizationParams.${key}\`: expected a string value, got ${typeof value}.`
+      );
+      continue;
+    }
+    if (key.trim() === "") continue;
+    out[key] = value;
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function cleanEndpointOverride(value, field) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "string") {
+    console.warn(
+      `Ignoring \`oauth.${field}\`: expected a string, got ${typeof value}.`
+    );
+    return void 0;
+  }
+  return value.trim() || void 0;
+}
 function storedFieldsToInspectorSettings(stored) {
   const hasAny = stored.headers !== void 0 || stored.metadata !== void 0 || stored.connectionTimeout !== void 0 || stored.requestTimeout !== void 0 || stored.taskTtl !== void 0 || stored.autoRefreshOnListChanged !== void 0 || stored.paginatedLists !== void 0 || stored.advertisedExtensions !== void 0 || stored.maxFetchRequests !== void 0 || stored.oauth !== void 0 || stored.roots !== void 0 || stored.protocolEra !== void 0 || stored.modernLogLevel !== void 0 || stored.env !== void 0 || stored.cwd !== void 0;
   if (!hasAny) return void 0;
@@ -187,7 +296,7 @@ function storedFieldsToInspectorSettings(stored) {
   const settings = {
     headers: headersPairs,
     env: envRecordToPairs(stored.env),
-    metadata: stored.metadata ?? [],
+    metadata: normalizeStoredMetadata(stored.metadata),
     connectionTimeout: stored.connectionTimeout ?? 0,
     requestTimeout: stored.requestTimeout ?? 0,
     // Unlike the timeouts (0 = "SDK default"), task TTL has a concrete product
@@ -217,12 +326,28 @@ function storedFieldsToInspectorSettings(stored) {
   if (stored.oauth?.clientSecret)
     settings.oauthClientSecret = stored.oauth.clientSecret;
   if (stored.oauth?.scopes) settings.oauthScopes = stored.oauth.scopes;
+  const authorizationParams = cleanAuthorizationParams(
+    stored.oauth?.authorizationParams
+  );
+  if (authorizationParams) {
+    settings.oauthAuthorizationParams = envRecordToPairs(authorizationParams);
+  }
+  const authorizationUrl = cleanEndpointOverride(
+    stored.oauth?.authorizationUrl,
+    "authorizationUrl"
+  );
+  if (authorizationUrl) settings.oauthAuthorizationUrl = authorizationUrl;
+  const tokenUrl = cleanEndpointOverride(stored.oauth?.tokenUrl, "tokenUrl");
+  if (tokenUrl) settings.oauthTokenUrl = tokenUrl;
   if (stored.oauth?.onInsufficientScope) {
     settings.oauthOnInsufficientScope = stored.oauth.onInsufficientScope;
   }
   if (stored.oauth?.enterpriseManaged === true) {
     settings.enterpriseManaged = true;
   }
+  if (stored.oauth?.requestRefreshToken === false) {
+    settings.oauthRequestRefreshToken = false;
+  }
   if (stored.cwd) settings.cwd = stored.cwd;
   return settings;
 }
@@ -236,9 +361,8 @@ function inspectorSettingsToStoredFields(settings) {
   if (Object.keys(headersRecord).length > 0) {
     out.headers = headersRecord;
   }
-  const metadataFiltered = settings.metadata.filter((m) => m.key.trim() !== "");
-  if (metadataFiltered.length > 0) {
-    out.metadata = metadataFiltered;
+  if (Object.keys(settings.metadata).length > 0) {
+    out.metadata = settings.metadata;
   }
   if (settings.connectionTimeout > 0) {
     out.connectionTimeout = settings.connectionTimeout;
@@ -272,12 +396,27 @@ function inspectorSettingsToStoredFields(settings) {
   if (settings.oauthClientSecret)
     oauthFields.clientSecret = settings.oauthClientSecret;
   if (settings.oauthScopes) oauthFields.scopes = settings.oauthScopes;
+  if (settings.oauthAuthorizationParams) {
+    const authParams = envPairsToRecord(settings.oauthAuthorizationParams);
+    if (Object.keys(authParams).length > 0) {
+      oauthFields.authorizationParams = authParams;
+    }
+  }
+  if (settings.oauthAuthorizationUrl?.trim()) {
+    oauthFields.authorizationUrl = settings.oauthAuthorizationUrl.trim();
+  }
+  if (settings.oauthTokenUrl?.trim()) {
+    oauthFields.tokenUrl = settings.oauthTokenUrl.trim();
+  }
   if (settings.oauthOnInsufficientScope) {
     oauthFields.onInsufficientScope = settings.oauthOnInsufficientScope;
   }
   if (settings.enterpriseManaged === true) {
     oauthFields.enterpriseManaged = true;
   }
+  if (settings.oauthRequestRefreshToken === false) {
+    oauthFields.requestRefreshToken = false;
+  }
   if (Object.keys(oauthFields).length > 0) {
     out.oauth = oauthFields;
   }
@@ -318,14 +457,7 @@ function extractSecretsFromStored(stored) {
   const stripped = { ...stored };
   if (stored.oauth?.clientSecret) {
     secrets[SECRET_FIELD_OAUTH_CLIENT_SECRET] = stored.oauth.clientSecret;
-    const restOauth = {};
-    if (stored.oauth.clientId !== void 0)
-      restOauth.clientId = stored.oauth.clientId;
-    if (stored.oauth.scopes !== void 0)
-      restOauth.scopes = stored.oauth.scopes;
-    if (stored.oauth.enterpriseManaged === true) {
-      restOauth.enterpriseManaged = true;
-    }
+    const { clientSecret: _clientSecret, ...restOauth } = stored.oauth;
     if (Object.keys(restOauth).length > 0) {
       stripped.oauth = restOauth;
     } else {
@@ -608,6 +740,7 @@ function resolveServerConfigs(options, mode) {
 }
 
 // server/web-server-config.ts
+import open from "open";
 import pino from "pino";
 
 // ../../core/mcp/remote/constants.ts
@@ -621,6 +754,49 @@ var API_SERVER_ENV_VARS = {
 };
 var INSPECTOR_API_TOKEN_GLOBAL = "__INSPECTOR_API_TOKEN__";
 
+// ../../core/auth/secret-storage-info.ts
+function secretStorageLabel(info) {
+  switch (info.kind) {
+    case "keyring":
+      return "OS keychain";
+    case "file":
+      if (info.encryptionUnknown !== void 0) return "File (unreadable)";
+      return info.plaintext ? "File (unencrypted)" : "File (encrypted)";
+    case "memory":
+      return "Memory (this session only)";
+  }
+}
+function secretStorageCaveat(info) {
+  if (info.kind === "memory") {
+    return "Secrets are not written anywhere and are lost on exit.";
+  }
+  if (info.looseMode !== void 0) {
+    const mode = info.looseMode.toString(8).padStart(4, "0");
+    if (info.encryptionUnknown !== void 0) {
+      return `The secrets file is mode ${mode}, not 0600, and could not be tightened \u2014 others can copy it, and whether that exposes the secrets depends on encryption this build could not determine (${info.encryptionUnknown}).`;
+    }
+    return info.plaintext === false ? `The secrets file is mode ${mode}, not 0600, and could not be tightened \u2014 others can copy it, and the passphrase is then the only thing protecting its contents.` : `The secrets file is mode ${mode}, not 0600, and could not be tightened \u2014 anyone who can read it can read the secrets in it.`;
+  }
+  if (info.permissionsUnknown !== void 0) {
+    return `The secrets file's permissions could not be checked (${info.permissionsUnknown}), so it is not known whether others can read it.`;
+  }
+  if (info.encryptionUnknown !== void 0) {
+    return `The secrets file could not be read (${info.encryptionUnknown}). Saving a secret will fail rather than overwrite it.`;
+  }
+  if (info.plaintext) {
+    return info.pendingEncryption ? "Existing secrets in this file are still unencrypted (file mode 0600). They are re-encrypted the next time a secret is saved." : "Secrets are stored unencrypted (file mode 0600). Set MCP_INSPECTOR_SECRET_KEY to encrypt them.";
+  }
+  return void 0;
+}
+function secretStorageSummary(info) {
+  const parts = [secretStorageLabel(info)];
+  if (info.path) parts.push(`at ${info.path}`);
+  if (info.reason === "fallback") {
+    parts.push("\u2014 fell back from the OS keychain");
+  }
+  return parts.join(" ");
+}
+
 // ../../core/node/version.ts
 import { readFileSync as readFileSync2 } from "fs";
 import { dirname as dirname3, join as join2, parse } from "path";
@@ -710,12 +886,34 @@ function isAllInterfacesHost(host) {
   return ALL_INTERFACES_LITERALS.has(normalized) || isAllZeroIpv4(normalized);
 }
 
+// server/resolve-bind-host.ts
+var BIND_ALL_INTERFACES_ENV = "DANGEROUSLY_BIND_ALL_INTERFACES";
+function isEnabled(value) {
+  const v = value?.trim().toLowerCase();
+  return v === "true" || v === "1";
+}
+var DEFAULT_BIND_HOST = "127.0.0.1";
+function resolveBindHostname(env = process.env) {
+  const host = (env.HOST ?? DEFAULT_BIND_HOST).trim();
+  if (isAllInterfacesHost(host) && !isEnabled(env[BIND_ALL_INTERFACES_ENV])) {
+    const resolved2 = canonicalUrlHost(host);
+    const shown = stripBrackets(resolved2) === stripBrackets(host.toLowerCase()) ? `HOST="${host}"` : `HOST="${host}" (resolves to ${resolved2})`;
+    throw new Error(
+      `Refusing to bind ${shown}: this exposes the MCP Inspector to your entire network, and its backend can spawn local processes and connect to MCP servers on your behalf \u2014 the exposure DNS-rebinding attacks target. Bind a loopback host (localhost / 127.0.0.1) instead. To override \u2014 only inside an isolated container or trusted network \u2014 set ${BIND_ALL_INTERFACES_ENV}=true.`
+    );
+  }
+  return stripBrackets(host);
+}
+
 // server/sandbox-controller.ts
 var __dirname = dirname4(fileURLToPath2(import.meta.url));
 var LOOPBACK_FRAME_ANCESTORS = ["http://127.0.0.1:*", "http://localhost:*"];
 var CSP_HOST_SOURCE = /^[a-z][a-z0-9+.-]*:\/\/[^\s;,'"[\]*]+$/i;
 function sandboxFrameAncestors(allowedOrigins) {
-  const valid = (allowedOrigins ?? []).filter((o) => CSP_HOST_SOURCE.test(o));
+  return frameAncestorsDirective(allowedOrigins);
+}
+function frameAncestorsDirective(origins) {
+  const valid = (origins ?? []).filter((o) => CSP_HOST_SOURCE.test(o));
   const sources = valid.length > 0 ? valid : LOOPBACK_FRAME_ANCESTORS;
   return `frame-ancestors ${sources.join(" ")}`;
 }
@@ -725,6 +923,7 @@ function parseListenPort(raw) {
   const n = parseInt(v, 10);
   return n <= 65535 ? n : void 0;
 }
+var DEFAULT_SANDBOX_PORT = 6275;
 function resolveSandboxPort() {
   const fromSandbox = parseListenPort(process.env.MCP_SANDBOX_PORT);
   if (fromSandbox === void 0 && process.env.MCP_SANDBOX_PORT?.trim()) {
@@ -732,10 +931,10 @@ function resolveSandboxPort() {
       `Ignoring invalid MCP_SANDBOX_PORT="${process.env.MCP_SANDBOX_PORT}" (need an integer 0\u201365535); falling back.`
     );
   }
-  return fromSandbox ?? parseListenPort(process.env.SERVER_PORT) ?? 0;
+  return fromSandbox ?? parseListenPort(process.env.SERVER_PORT) ?? DEFAULT_SANDBOX_PORT;
 }
 function createSandboxController(options) {
-  const { port, host = "localhost", allowedOrigins } = options;
+  const { port, host = DEFAULT_BIND_HOST, allowedOrigins } = options;
   let server = null;
   let sandboxUrl = null;
   const SANDBOX_PROXY_CSP = sandboxFrameAncestors(allowedOrigins);
@@ -752,12 +951,12 @@ function createSandboxController(options) {
         const p = parseInt(new URL(sandboxUrl).port, 10);
         return { port: p, url: sandboxUrl };
       }
-      return new Promise((resolve6) => {
+      return new Promise((resolve9) => {
         let settled = false;
         const settle = (value) => {
           if (settled) return;
           settled = true;
-          resolve6(value);
+          resolve9(value);
         };
         server = createServer((req, res) => {
           if (req.method !== "GET" || req.url !== "/sandbox" && req.url !== "/sandbox/") {
@@ -773,8 +972,17 @@ function createSandboxController(options) {
           });
           res.end(sandboxHtml);
         });
+        let retriedDynamic = false;
         server.on("error", (err) => {
           if (err.code === "EADDRINUSE") {
+            if (!retriedDynamic && port !== 0) {
+              retriedDynamic = true;
+              console.warn(
+                `Sandbox: port ${port} in use; falling back to an OS-assigned port. The MCP Apps tab will work locally, but the sandbox is no longer on a predictable port \u2014 set MCP_SANDBOX_PORT to a free one if you need to forward it (container / SSH tunnel / reverse proxy).`
+              );
+              server.listen(0, host);
+              return;
+            }
             console.error(
               `Sandbox: port ${port || "dynamic"} in use. MCP Apps tab may not work.`
             );
@@ -802,11 +1010,11 @@ function createSandboxController(options) {
     },
     async close() {
       if (!server) return;
-      return new Promise((resolve6) => {
+      return new Promise((resolve9) => {
         server.close(() => {
           server = null;
           sandboxUrl = null;
-          resolve6();
+          resolve9();
         });
       });
     },
@@ -816,22 +1024,167 @@ function createSandboxController(options) {
   };
 }
 
-// server/resolve-bind-host.ts
-var BIND_ALL_INTERFACES_ENV = "DANGEROUSLY_BIND_ALL_INTERFACES";
-function isEnabled(value) {
-  const v = value?.trim().toLowerCase();
-  return v === "true" || v === "1";
+// server/app-origin-controller.ts
+import { createServer as createServer2 } from "http";
+import { randomBytes } from "crypto";
+var DEFAULT_APP_ORIGIN_PORT = 6278;
+var MAX_DOCUMENTS = 32;
+var MAX_RETAINED_CHARS = 64 * 1024 * 1024;
+var DOCUMENT_TTL_MS = 60 * 60 * 1e3;
+function appDocumentEmbedders(sandboxUrl, allowedOrigins) {
+  const origins = [];
+  if (sandboxUrl) {
+    try {
+      origins.push(new URL(sandboxUrl).origin);
+    } catch {
+    }
+  }
+  origins.push(...allowedOrigins ?? []);
+  return origins.length > 0 ? origins : void 0;
 }
-function resolveBindHostname(env = process.env) {
-  const host = (env.HOST ?? "localhost").trim();
-  if (isAllInterfacesHost(host) && !isEnabled(env[BIND_ALL_INTERFACES_ENV])) {
-    const resolved = canonicalUrlHost(host);
-    const shown = stripBrackets(resolved) === stripBrackets(host.toLowerCase()) ? `HOST="${host}"` : `HOST="${host}" (resolves to ${resolved})`;
-    throw new Error(
-      `Refusing to bind ${shown}: this exposes the MCP Inspector to your entire network, and its backend can spawn local processes and connect to MCP servers on your behalf \u2014 the exposure DNS-rebinding attacks target. Bind a loopback host (localhost / 127.0.0.1) instead. To override \u2014 only inside an isolated container or trusted network \u2014 set ${BIND_ALL_INTERFACES_ENV}=true.`
+function parseListenPort2(raw) {
+  const v = raw?.trim();
+  if (!v || !/^\d+$/.test(v)) return void 0;
+  const n = parseInt(v, 10);
+  return n <= 65535 ? n : void 0;
+}
+function resolveAppOriginPort() {
+  const parsed = parseListenPort2(process.env.MCP_APP_ORIGIN_PORT);
+  if (parsed === void 0 && process.env.MCP_APP_ORIGIN_PORT?.trim()) {
+    console.warn(
+      `Ignoring invalid MCP_APP_ORIGIN_PORT="${process.env.MCP_APP_ORIGIN_PORT}" (need an integer 0\u201365535); falling back.`
     );
   }
-  return stripBrackets(host);
+  return parsed ?? DEFAULT_APP_ORIGIN_PORT;
+}
+var DOC_PATH_PREFIX = "/app-document/";
+function parseDocumentId(url) {
+  if (!url || !url.startsWith(DOC_PATH_PREFIX)) return null;
+  const id = url.slice(DOC_PATH_PREFIX.length).split(/[?#]/)[0];
+  return /^[0-9a-f]{32}$/.test(id ?? "") ? id ?? null : null;
+}
+function createAppOriginController(options) {
+  const { port, host = DEFAULT_BIND_HOST, embedderOrigins } = options;
+  let server = null;
+  let origin = null;
+  const documents = /* @__PURE__ */ new Map();
+  let retainedChars = 0;
+  function drop(id) {
+    const doc = documents.get(id);
+    if (!doc) return;
+    retainedChars -= doc.size;
+    documents.delete(id);
+  }
+  const FRAME_ANCESTORS = frameAncestorsDirective(embedderOrigins);
+  function evictExpired(now) {
+    for (const [id, doc] of documents) {
+      if (doc.expiresAt <= now) drop(id);
+    }
+  }
+  return {
+    async start() {
+      if (server && origin) {
+        return { port: parseInt(new URL(origin).port, 10), url: origin };
+      }
+      return new Promise((resolve9) => {
+        let settled = false;
+        const settle = (value) => {
+          if (settled) return;
+          settled = true;
+          resolve9(value);
+        };
+        server = createServer2((req, res) => {
+          const id = req.method === "GET" ? parseDocumentId(req.url) : null;
+          const doc = id ? documents.get(id) : void 0;
+          if (!doc || doc.expiresAt <= Date.now()) {
+            if (id) drop(id);
+            res.writeHead(404, { "Content-Type": "text/plain" });
+            res.end("Not Found");
+            return;
+          }
+          res.writeHead(200, {
+            "Content-Type": "text/html; charset=utf-8",
+            "Cache-Control": "no-store, no-cache, must-revalidate",
+            Pragma: "no-cache",
+            // `nosniff` matters more here than on a page we authored: these
+            // bytes are server-supplied and untrusted.
+            "X-Content-Type-Options": "nosniff",
+            // The per-app policy as a real header. It is the same policy baked
+            // into the document's <meta>; delivering both is deliberate —
+            // multiple policies intersect, and two copies of one policy
+            // intersect to itself, so this can only ever be at least as strict.
+            "Content-Security-Policy": doc.csp ? `${doc.csp}; ${FRAME_ANCESTORS}` : FRAME_ANCESTORS
+          });
+          res.end(doc.html);
+        });
+        let retriedDynamic = false;
+        server.on("error", (err) => {
+          if (err.code === "EADDRINUSE") {
+            if (!retriedDynamic && port !== 0) {
+              retriedDynamic = true;
+              console.warn(
+                `App origin: port ${port} in use; falling back to an OS-assigned port. Apps declaring _meta.ui.domain will still render, but the origin they are served from is no longer predictable \u2014 set MCP_APP_ORIGIN_PORT to a free one if your app's backend allowlists it.`
+              );
+              server.listen(0, host);
+              return;
+            }
+            console.error(
+              `App origin: port ${port || "dynamic"} in use. Apps declaring _meta.ui.domain will fall back to an opaque origin.`
+            );
+          } else {
+            console.error("App origin server error:", err);
+          }
+          server = null;
+          origin = null;
+          documents.clear();
+          retainedChars = 0;
+          settle({ port: 0, url: "" });
+        });
+        server.listen(port, host, () => {
+          const addr = server.address();
+          if (typeof addr !== "object" || addr === null) {
+            settle({ port: 0, url: "" });
+            return;
+          }
+          const actualPort = addr.port;
+          const canonicalHost = canonicalUrlHost(host);
+          const urlHost = isAllInterfacesHost(canonicalHost) ? "localhost" : canonicalHost;
+          origin = `http://${urlHost}:${actualPort}`;
+          settle({ port: actualPort, url: origin });
+        });
+      });
+    },
+    async close() {
+      documents.clear();
+      retainedChars = 0;
+      if (!server) return;
+      return new Promise((resolve9) => {
+        server.close(() => {
+          server = null;
+          origin = null;
+          resolve9();
+        });
+      });
+    },
+    getOrigin() {
+      return origin;
+    },
+    publish(doc) {
+      if (!origin) return null;
+      const now = Date.now();
+      evictExpired(now);
+      const size = doc.html.length + (doc.csp?.length ?? 0);
+      while (documents.size >= MAX_DOCUMENTS || documents.size > 0 && retainedChars + size > MAX_RETAINED_CHARS) {
+        const oldest = documents.keys().next();
+        if (oldest.done) break;
+        drop(oldest.value);
+      }
+      const id = randomBytes(16).toString("hex");
+      documents.set(id, { ...doc, expiresAt: now + DOCUMENT_TTL_MS, size });
+      retainedChars += size;
+      return { url: `${origin}${DOC_PATH_PREFIX}${id}` };
+    }
+  };
 }
 
 // server/web-server-config.ts
@@ -863,8 +1216,16 @@ function defaultEnvironmentFromProcess(extra) {
   }
   return out;
 }
-function webServerConfigToInitialPayload(config) {
-  return { ...transportDefaults(config), version: inspectorVersion };
+function webServerConfigToInitialPayload(config, secretStorage) {
+  return {
+    ...transportDefaults(config),
+    version: inspectorVersion,
+    // Omitted rather than defaulted when the caller didn't resolve a store:
+    // the UI treats an absent descriptor as "unknown" and shows nothing,
+    // which is the only honest rendering. A default of "keychain" would put a
+    // confident wrong answer under the field where a secret is typed.
+    ...secretStorage ? { secretStorage } : {}
+  };
 }
 function transportDefaults(config) {
   const mc = config.initialMcpConfig;
@@ -904,7 +1265,7 @@ function transportDefaults(config) {
     defaultEnvironment
   };
 }
-function printServerBanner(config, actualPort, resolvedToken, sandboxUrl) {
+function printServerBanner(config, actualPort, resolvedToken, sandboxUrl, secretStorage) {
   const h = canonicalUrlHost(config.hostname);
   const bannerHost = isAllInterfacesHost(h) ? "localhost" : h;
   const baseUrl = httpOrigin(bannerHost, actualPort);
@@ -921,6 +1282,10 @@ MCP Inspector Web is up and running at:
     console.log("   Auth: disabled (DANGEROUSLY_OMIT_AUTH)\n");
   } else {
     console.log(`   Auth token: ${resolvedToken}
+`);
+  }
+  if (secretStorage) {
+    console.log(`   Secrets: ${secretStorageSummary(secretStorage)}
 `);
   }
   if (config.autoOpen) {
@@ -928,6 +1293,11 @@ MCP Inspector Web is up and running at:
   }
   return url;
 }
+function openBrowser(url) {
+  open(url).catch((err) => {
+    console.warn("Could not open a browser automatically:", err);
+  });
+}
 var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
 function httpOrigin(host, port) {
   return port === 80 ? `http://${host}` : `http://${host}:${port}`;
@@ -971,6 +1341,14 @@ function buildWebServerConfig(options = {}) {
   const dangerouslyOmitAuth = !!process.env.DANGEROUSLY_OMIT_AUTH;
   const authToken = dangerouslyOmitAuth ? "" : process.env[API_SERVER_ENV_VARS.AUTH_TOKEN] ?? process.env[LEGACY_AUTH_TOKEN_ENV] ?? "";
   const sandboxPort = resolveSandboxPort();
+  const requestedAppOriginPort = resolveAppOriginPort();
+  const appOriginCollidesWith = requestedAppOriginPort !== 0 && (requestedAppOriginPort === port ? "the web server (CLIENT_PORT)" : requestedAppOriginPort === sandboxPort ? "the MCP Apps sandbox (MCP_SANDBOX_PORT)" : null);
+  if (appOriginCollidesWith) {
+    console.warn(
+      `App origin: port ${requestedAppOriginPort} is already ${appOriginCollidesWith}; using an OS-assigned port instead. Apps declaring _meta.ui.domain will still render, but the origin they are served from is no longer predictable \u2014 set MCP_APP_ORIGIN_PORT to a free one if your app's backend allowlists it.`
+    );
+  }
+  const appOriginPort = appOriginCollidesWith ? 0 : requestedAppOriginPort;
   let logger;
   if (process.env.MCP_LOG_FILE) {
     logger = pino(
@@ -1006,6 +1384,7 @@ function buildWebServerConfig(options = {}) {
     allowedOrigins: configuredOrigins?.length ? configuredOrigins : defaultAllowedOrigins(hostname, port),
     sandboxPort,
     sandboxHost: hostname,
+    appOriginPort,
     logger,
     autoOpen: resolveAutoOpen()
   };
@@ -1018,21 +1397,19 @@ function resolveAutoOpen() {
 }
 
 // server/start-vite-dev-server.ts
-import { join as join6, dirname as dirname5, resolve as resolve3 } from "path";
+import { join as join7, dirname as dirname7, resolve as resolve6 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
-import { createServer as createServer2 } from "vite";
+import { createServer as createServer3 } from "vite";
 import react from "@vitejs/plugin-react";
 
-// server/vite-hono-plugin.ts
-import open from "open";
-
 // ../../core/mcp/remote/node/server.ts
-import { randomBytes, timingSafeEqual } from "crypto";
-import { existsSync as existsSync2, readFileSync as readFileSync4 } from "fs";
+import { randomBytes as randomBytes3, timingSafeEqual } from "crypto";
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
 import { stat as fsStat } from "fs/promises";
 import { homedir } from "os";
 import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
+import { bodyLimit } from "hono/body-limit";
 import { watch as chokidarWatch } from "chokidar";
 
 // ../../core/mcp/config.ts
@@ -1347,6 +1724,7 @@ function parseAuthChallengeFromResponse(response, context) {
   return {
     reason: reasonFromHttpResponse(status, bearer),
     ...requiredScopes.length > 0 ? { requiredScopes } : {},
+    ...bearer.resourceMetadata ? { resourceMetadataUrl: bearer.resourceMetadata } : {},
     ...bearer.errorDescription ? { message: bearer.errorDescription } : {},
     ...context ? { context } : {},
     raw: {
@@ -1376,8 +1754,26 @@ function createAuthChallengeInterceptFetch(baseFetch) {
     );
   };
 }
+function createAuthChallengeObserverFetch(baseFetch, onChallenge) {
+  return async (input, init) => {
+    const response = await baseFetch(input, init);
+    if (response.status === 401 || response.status === 403) {
+      const challenge = parseAuthChallengeFromResponse(response);
+      if (challenge) {
+        onChallenge(challenge);
+      }
+    }
+    return response;
+  };
+}
 
-// ../../core/mcp/node/transport.ts
+// ../../core/mcp/node/proxyFetch.ts
+function asUndiciInit(init) {
+  return init;
+}
+function asBodyInit(body) {
+  return body;
+}
 var PROXY_ENV_VARS = [
   "HTTPS_PROXY",
   "https_proxy",
@@ -1391,27 +1787,95 @@ function readProxyEnv() {
   }
   return void 0;
 }
-function withProxyDispatcher(baseFetch) {
-  if (readProxyEnv() === void 0) return baseFetch;
-  let dispatcherPromise;
-  const getDispatcher = () => {
-    dispatcherPromise ??= import("./undici-HXPKCIY3.js").then(
-      ({ EnvHttpProxyAgent }) => new EnvHttpProxyAgent(),
-      (cause) => {
-        throw new Error(
-          "HTTPS_PROXY / HTTP_PROXY is set but the `undici` package is not available. Install it (it ships with the CLI client) or unset the proxy env var.",
-          { cause }
-        );
-      }
+var NULL_BODY_STATUSES = /* @__PURE__ */ new Set([
+  101,
+  103,
+  204,
+  205,
+  304
+]);
+function toGlobalResponse(res) {
+  const headers = new Headers();
+  for (const [key, value] of res.headers) headers.append(key, value);
+  const out = new Response(
+    NULL_BODY_STATUSES.has(res.status) ? null : asBodyInit(res.body),
+    {
+      status: res.status,
+      statusText: res.statusText,
+      headers
+    }
+  );
+  for (const [key, value] of [
+    ["url", res.url],
+    ["redirected", res.redirected],
+    ["type", res.type]
+  ]) {
+    Object.defineProperty(out, key, {
+      value,
+      configurable: true,
+      enumerable: false
+    });
+  }
+  return out;
+}
+var loadedProxiedFetch;
+async function loadProxiedFetch() {
+  let undici;
+  try {
+    undici = await import("undici");
+  } catch (cause) {
+    throw new Error(
+      "HTTPS_PROXY / HTTP_PROXY is set but the `undici` package could not be loaded, so requests cannot be routed through the proxy. This is a packaging fault rather than something to fix by installing undici; please report it, or unset the proxy env var to fall back to a direct connection.",
+      { cause }
+    );
+  }
+  const dispatcher = new undici.EnvHttpProxyAgent();
+  return async (input, init) => {
+    const [target, requestInit] = toUndiciRequest(input, init);
+    return toGlobalResponse(
+      await undici.fetch(target, { ...asUndiciInit(requestInit), dispatcher })
     );
-    return dispatcherPromise;
   };
-  const proxiedFetch = async (input, init) => {
-    const dispatcher = await getDispatcher();
-    return baseFetch(input, { ...init, dispatcher });
+}
+function toUndiciRequest(input, init) {
+  if (input instanceof Request) {
+    return [
+      input.url,
+      {
+        method: input.method,
+        headers: input.headers,
+        // A stream body needs `duplex: "half"`; the field is undici's, not in
+        // the DOM `RequestInit`, so it rides along as an extra property.
+        ...input.body ? { body: input.body, duplex: "half" } : {},
+        signal: input.signal,
+        // Everything else the Request carries. Dropping these would silently
+        // change fetch semantics under a proxy — most visibly `redirect`, where
+        // a `new Request(url, { redirect: "manual" })` would start following
+        // redirects instead of surfacing them.
+        redirect: input.redirect,
+        cache: input.cache,
+        credentials: input.credentials,
+        integrity: input.integrity,
+        keepalive: input.keepalive,
+        mode: input.mode,
+        referrer: input.referrer,
+        referrerPolicy: input.referrerPolicy,
+        // An explicit `init` still wins, per the fetch contract.
+        ...init
+      }
+    ];
+  }
+  return [input instanceof URL ? input.href : input, init ?? {}];
+}
+function createProxyFetch() {
+  if (readProxyEnv() === void 0) return void 0;
+  return async (input, init) => {
+    loadedProxiedFetch ??= loadProxiedFetch();
+    return (await loadedProxiedFetch)(input, init);
   };
-  return proxiedFetch;
 }
+
+// ../../core/mcp/node/transport.ts
 function headersFromSettings(settings) {
   if (!settings || settings.headers.length === 0) return void 0;
   const out = {};
@@ -1431,10 +1895,12 @@ function createTransportNode(config, options = {}) {
     onFetchResponseBody,
     authProvider,
     settings,
-    interceptAuthChallenges = false
+    interceptAuthChallenges = false,
+    onAuthChallengeObserved
   } = options;
-  const baseFetch = withProxyDispatcher(optionsFetchFn ?? globalThis.fetch);
-  const fetchWithOptionalAuthIntercept = interceptAuthChallenges ? createAuthChallengeInterceptFetch(baseFetch) : baseFetch;
+  const baseFetch = optionsFetchFn ?? createProxyFetch() ?? globalThis.fetch;
+  const withChallengeObserver = (inner) => onAuthChallengeObserved ? createAuthChallengeObserverFetch(inner, onAuthChallengeObserved) : inner;
+  const fetchWithOptionalAuthIntercept = interceptAuthChallenges ? createAuthChallengeInterceptFetch(withChallengeObserver(baseFetch)) : withChallengeObserver(baseFetch);
   if (serverType === "stdio") {
     const stdioConfig = config;
     const transport = new StdioClientTransport({
@@ -1459,7 +1925,8 @@ function createTransportNode(config, options = {}) {
   } else if (serverType === "sse") {
     const sseConfig = config;
     const url = new URL(sseConfig.url);
-    const sseFetch = sseConfig.eventSourceInit?.fetch || fetchWithOptionalAuthIntercept;
+    const configuredSseFetch = sseConfig.eventSourceInit?.fetch;
+    const sseFetch = configuredSseFetch ? withChallengeObserver(configuredSseFetch) : fetchWithOptionalAuthIntercept;
     const trackedFetch = onFetchRequest ? createFetchTracker(sseFetch, {
       trackRequest: onFetchRequest,
       updateResponseBody: onFetchResponseBody
@@ -1637,27 +2104,27 @@ function resolveImportSource(type, platform, homeDir, readFile2) {
   const strategy = getImportStrategy(type);
   if (!strategy) return null;
   const searched = strategy.defaultPaths(platform, homeDir);
-  for (const path3 of searched) {
+  for (const path6 of searched) {
     let raw;
     try {
-      raw = readFile2(path3);
+      raw = readFile2(path6);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       return {
         type,
         found: true,
-        path: path3,
-        error: `Failed to read ${path3}: ${msg}`,
+        path: path6,
+        error: `Failed to read ${path6}: ${msg}`,
         searched
       };
     }
     if (raw === null) continue;
     try {
       const config = strategy.parse(raw);
-      return { type, found: true, path: path3, config, searched };
+      return { type, found: true, path: path6, config, searched };
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      return { type, found: true, path: path3, error: msg, searched };
+      return { type, found: true, path: path6, error: msg, searched };
     }
   }
   return { type, found: false, searched };
@@ -1781,7 +2248,7 @@ var RemoteSession = class _RemoteSession {
    * `auth_challenge` or `ok: true` only after the MCP round-trip (or auth error).
    */
   waitForRequestResponse(requestId, timeoutMs = 6e4) {
-    return new Promise((resolve6, reject) => {
+    return new Promise((resolve9, reject) => {
       const timer = timeoutMs > 0 ? setTimeout(() => {
         this.requestWaits.delete(requestId);
         reject(
@@ -1795,7 +2262,7 @@ var RemoteSession = class _RemoteSession {
           if (timer !== void 0) {
             clearTimeout(timer);
           }
-          resolve6();
+          resolve9();
         },
         reject: (error) => {
           if (timer !== void 0) {
@@ -1975,130 +2442,1372 @@ function createRemoteAuthProvider(initialAuthState) {
     }
   };
 }
-
-// ../../core/auth/node/secret-store.ts
-var SERVICE_NAME = "mcp-inspector";
-var keyringLoad;
-var KeyringModuleShapeError = class extends Error {
-  constructor(detail, options) {
-    super(`@napi-rs/keyring loaded but ${detail}`, options);
-    this.name = "KeyringModuleShapeError";
+
+// ../../core/auth/node/secret-store.ts
+var SERVICE_NAME = "mcp-inspector";
+var keyringLoad;
+var KeyringModuleShapeError = class extends Error {
+  constructor(detail, options) {
+    super(`@napi-rs/keyring loaded but ${detail}`, options);
+    this.name = "KeyringModuleShapeError";
+  }
+};
+var checkKeyringShape = (mod) => {
+  try {
+    if (typeof mod.AsyncEntry === "function" && typeof mod.findCredentialsAsync === "function") {
+      return { ok: true, mod };
+    }
+    return {
+      ok: false,
+      err: new KeyringModuleShapeError(
+        "did not expose AsyncEntry / findCredentialsAsync"
+      )
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      err: new KeyringModuleShapeError(
+        `its exports could not be read: ${err instanceof Error ? err.message : String(err)}`,
+        { cause: err }
+      )
+    };
+  }
+};
+var loadKeyring = () => {
+  keyringLoad ??= import("@napi-rs/keyring").then(
+    checkKeyringShape,
+    (err) => ({ ok: false, err })
+  );
+  return keyringLoad;
+};
+function parseAccount(account) {
+  const idx = account.indexOf(":");
+  if (idx <= 0 || idx === account.length - 1) return null;
+  return {
+    serverId: account.slice(0, idx),
+    field: account.slice(idx + 1)
+  };
+}
+var buildAccount = (serverId, field) => `${serverId}:${field}`;
+var SecretStoreUnavailableError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "SecretStoreUnavailableError";
+  }
+};
+var KeychainUnavailableError = class extends SecretStoreUnavailableError {
+  constructor(cause) {
+    const message = cause instanceof Error ? cause.message : String(cause);
+    super(
+      `OS keychain is not available. ${hintFor(cause, message)} Underlying error: ${message}`
+    );
+    this.name = "KeychainUnavailableError";
+  }
+};
+var hintFor = (cause, message) => {
+  if (cause instanceof KeyringModuleShapeError) {
+    return `The @napi-rs/keyring package loaded but does not expose the API this build expects \u2014 most likely a version or packaging mismatch; reinstall the Inspector, and report this if it persists.`;
+  }
+  if (message.includes("Cannot find native binding")) {
+    return `The @napi-rs/keyring platform package for this OS is missing or unavailable \u2014 reinstall the Inspector (for npx, clear the npx cache under your npm cache directory first).`;
+  }
+  return `On Linux, install libsecret / gnome-keyring.`;
+};
+async function probeKeyringAvailable() {
+  const keyring = await loadKeyring();
+  if (!keyring.ok) {
+    const err = keyring.err;
+    return {
+      available: false,
+      detail: err instanceof Error ? err.message : String(err)
+    };
+  }
+  try {
+    const entry = new keyring.mod.AsyncEntry(SERVICE_NAME, PROBE_ACCOUNT);
+    await entry.getPassword();
+    return { available: true };
+  } catch (err) {
+    return {
+      available: false,
+      detail: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+var PROBE_ACCOUNT = "__inspector:probe";
+var KeyringSecretStore = class {
+  /**
+   * The intolerant read. Same lookup as {@link get}, minus the catch — a
+   * keychain that cannot answer must not be reported as an empty one to a
+   * caller that is about to write based on the answer.
+   */
+  async getStrict(serverId, field) {
+    try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) throw new KeychainUnavailableError(keyring.err);
+      const entry = new keyring.mod.AsyncEntry(
+        SERVICE_NAME,
+        buildAccount(serverId, field)
+      );
+      return await entry.getPassword() ?? null;
+    } catch (err) {
+      if (err instanceof KeychainUnavailableError) throw err;
+      throw new KeychainUnavailableError(err);
+    }
+  }
+  async get(serverId, field) {
+    try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) return null;
+      const entry = new keyring.mod.AsyncEntry(
+        SERVICE_NAME,
+        buildAccount(serverId, field)
+      );
+      const v = await entry.getPassword();
+      return v ?? null;
+    } catch {
+      return null;
+    }
+  }
+  async set(serverId, field, value) {
+    try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) throw new KeychainUnavailableError(keyring.err);
+      const entry = new keyring.mod.AsyncEntry(
+        SERVICE_NAME,
+        buildAccount(serverId, field)
+      );
+      await entry.setPassword(value);
+    } catch (err) {
+      if (err instanceof KeychainUnavailableError) throw err;
+      throw new KeychainUnavailableError(err);
+    }
+  }
+  async delete(serverId, field) {
+    try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) return;
+      const entry = new keyring.mod.AsyncEntry(
+        SERVICE_NAME,
+        buildAccount(serverId, field)
+      );
+      await entry.deleteCredential();
+    } catch {
+    }
+  }
+  async deleteAllForServer(serverId) {
+    let creds;
+    try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) return;
+      creds = await keyring.mod.findCredentialsAsync(SERVICE_NAME);
+    } catch {
+      return;
+    }
+    const prefix = `${serverId}:`;
+    for (const c of creds) {
+      if (!c.account.startsWith(prefix)) continue;
+      const parsed = parseAccount(c.account);
+      if (!parsed || parsed.serverId !== serverId) continue;
+      await this.delete(serverId, parsed.field);
+    }
+  }
+};
+async function secretStoreGetStrict(store, serverId, field) {
+  return store.getStrict ? store.getStrict(serverId, field) : store.get(serverId, field);
+}
+async function secretStoreGetMany(store, requests) {
+  if (store.getMany) return store.getMany(requests);
+  const out = {};
+  await Promise.all(
+    requests.map(async ({ serverId, fields }) => {
+      const entries = await Promise.all(
+        fields.map(
+          async (field) => [field, await store.get(serverId, field)]
+        )
+      );
+      const found = {};
+      for (const [field, value] of entries) {
+        if (value !== null) found[field] = value;
+      }
+      out[serverId] = found;
+    })
+  );
+  return out;
+}
+async function secretStoreSetMany(store, serverId, values) {
+  if (store.setMany) return store.setMany(serverId, values);
+  await Promise.all(
+    Object.entries(values).map(
+      ([field, value]) => store.set(serverId, field, value)
+    )
+  );
+}
+async function secretStoreIsDurable(store) {
+  return store.isDurable ? store.isDurable() : true;
+}
+var InMemorySecretStore = class {
+  map = /* @__PURE__ */ new Map();
+  async get(serverId, field) {
+    return this.map.get(buildAccount(serverId, field)) ?? null;
+  }
+  async set(serverId, field, value) {
+    this.map.set(buildAccount(serverId, field), value);
+  }
+  async delete(serverId, field) {
+    this.map.delete(buildAccount(serverId, field));
+  }
+  async deleteAllForServer(serverId) {
+    const prefix = `${serverId}:`;
+    for (const key of [...this.map.keys()]) {
+      if (key.startsWith(prefix)) this.map.delete(key);
+    }
+  }
+};
+var SessionSecretStore = class extends InMemorySecretStore {
+  async isDurable() {
+    return false;
+  }
+};
+
+// ../../core/auth/node/secret-store-selection.ts
+import { randomUUID } from "crypto";
+import * as fsSync from "fs";
+import * as fs4 from "fs/promises";
+import * as path4 from "path";
+
+// ../../core/auth/node/file-secret-store.ts
+import * as crypto2 from "crypto";
+import * as fs3 from "fs/promises";
+import * as path3 from "path";
+
+// ../../core/auth/node/file-lock.ts
+import nodeFs, { statSync, rmdirSync } from "fs";
+import * as fs2 from "fs/promises";
+import * as path2 from "path";
+import properLockfile from "proper-lockfile";
+var STALE_MS = 1e4;
+var RETRY = {
+  retries: 20,
+  factor: 2,
+  minTimeout: 20,
+  maxTimeout: 1e3
+};
+var RETRY_BUDGET_MS = (() => {
+  let total = 0;
+  let delay = RETRY.minTimeout;
+  for (let i = 0; i < RETRY.retries; i++) {
+    total += Math.min(delay, RETRY.maxTimeout);
+    delay *= RETRY.factor;
+  }
+  return total;
+})();
+var warned = /* @__PURE__ */ new Set();
+function warnOnce(message) {
+  if (warned.has(message)) return;
+  warned.add(message);
+  console.warn(`[mcp-inspector] ${message}`);
+}
+function isStuckOrHeld(err, lockPath) {
+  return isHeldElsewhere(err) || identifySync(lockPath) !== null;
+}
+var isHeldElsewhere = (err) => err.code === "ELOCKED";
+var describeError = (err) => err instanceof Error ? err.message : String(err);
+var lockPathOf = (target) => `${target}.lock`;
+function identifySync(lockPath) {
+  try {
+    const stat2 = statSync(lockPath);
+    return { ino: stat2.ino, birthtimeMs: stat2.birthtimeMs };
+  } catch {
+    return null;
+  }
+}
+function guardedFs(lockPath, owned, onRefused) {
+  const mine = () => {
+    if (owned.id === null) return true;
+    const now = identifySync(lockPath);
+    if (now === null) return false;
+    return now.ino === owned.id.ino && now.birthtimeMs === owned.id.birthtimeMs;
+  };
+  const removeIfMine = () => {
+    if (!mine()) {
+      onRefused();
+      return;
+    }
+    rmdirSync(lockPath);
+  };
+  return {
+    ...nodeFs,
+    // **Identity is captured here, not after `lock()` resolves.** `mkdir` is
+    // the moment the directory becomes ours, and it is synchronous with
+    // respect to this process: recording it in the callback, before yielding,
+    // leaves no window. Capturing after the acquire promise settled — as this
+    // did originally — spans the library's own `utimes`/`stat` probe, and a
+    // waiter replacing our directory inside that span would have us record
+    // *the winner's* identity as our own, after which the guard below would
+    // cheerfully delete their lock.
+    mkdir: (p, cb) => {
+      nodeFs.mkdir(p, (err) => {
+        if (!err) owned.id = identifySync(lockPath);
+        cb(err);
+      });
+    },
+    // Reported as success when refused: the library's bookkeeping should
+    // forget this lock either way. Leaving it registered would hand the
+    // `signal-exit` handler a record pointing at the winner's directory.
+    rmdir: (_p, cb) => {
+      try {
+        removeIfMine();
+        cb(null);
+      } catch (err) {
+        cb(err);
+      }
+    },
+    /* v8 ignore next 3 -- @preserve: only reachable from proper-lockfile's
+       signal-exit handler, i.e. at real process exit, which no in-process
+       test can drive. Its logic is `removeIfMine`, covered via `rmdir`. */
+    rmdirSync: () => {
+      removeIfMine();
+    }
+  };
+}
+function acquire(target, retries, fsShim) {
+  return properLockfile.lock(target, {
+    realpath: false,
+    stale: STALE_MS,
+    retries,
+    // Every directory removal the library performs — on release and from its
+    // exit handler — routes through here. See `guardedFs`.
+    fs: fsShim,
+    // The library's default `onCompromised` *throws* — from a timer, with no
+    // caller on the stack, so it lands as an uncaught exception and takes the
+    // process down. This is also the library's *only* signal for the
+    // stale-takeover race described at the top of this file — someone
+    // declared our lock stale and replaced it — so it is the one place a user
+    // learns the guarantee was lost. Worth saying; not worth killing an
+    // Inspector session over.
+    onCompromised: (err) => warnOnce(
+      `The lock on the secrets file at ${target} was taken over by another process while a write was in progress (${err.message}). If a secret you just saved is missing, save it again.`
+    )
+  });
+}
+async function isFileLockHeld(filePath) {
+  try {
+    return await properLockfile.check(path2.resolve(filePath), {
+      realpath: false,
+      stale: STALE_MS
+    });
+  } catch {
+    return false;
+  }
+}
+async function openSecretFileLock(filePath) {
+  const target = path2.resolve(filePath);
+  await fs2.mkdir(path2.dirname(target), { recursive: true }).catch(() => {
+  });
+  const owned = { id: null };
+  const fsShim = guardedFs(
+    lockPathOf(target),
+    owned,
+    () => warnOnce(
+      `The lock on the secrets file at ${target} was taken over by another process while a write was in progress, so it was left alone rather than removed. If a secret you just saved is missing, save it again.`
+    )
+  );
+  let release;
+  try {
+    release = await acquire(target, 0, fsShim).catch((err) => {
+      if (!isStuckOrHeld(err, lockPathOf(target))) throw err;
+      return acquire(target, RETRY, fsShim);
+    });
+  } catch (err) {
+    if (isStuckOrHeld(err, lockPathOf(target))) {
+      throw new SecretStoreUnavailableError(
+        `Could not save to the secrets file at ${target}: its lock (${lockPathOf(target)}) was still held after the ${Math.round(RETRY_BUDGET_MS / 1e3)} seconds this save waited. Its secrets are intact; the value you just entered was not saved. If no other Inspector is running, remove that lock and try again.`
+      );
+    }
+    warnOnce(
+      `Could not take a lock on the secrets file at ${target} (${describeError(err)}), so writes to it are not protected against another process writing at the same moment.`
+    );
+    return null;
+  }
+  return async () => {
+    try {
+      await release();
+    } catch (err) {
+      if (err.code === "ERELEASED") return;
+      warnOnce(
+        // **Conditional, not an instruction.** Two blanket versions of this
+        // have now been wrong in opposite directions: "it expires on its own"
+        // (false whenever the same `rmdir` that blocked us also blocks stale
+        // takeover — `ENOTEMPTY`, `EACCES`, `EPERM`, `EROFS`), and "remove it
+        // by hand" (false whenever the failure was transient, since the path
+        // may by then hold a *different, live* Inspector's lock, and deleting
+        // that destroys the exclusion of a process that did nothing wrong).
+        //
+        // `proper-lockfile` forwards whatever the filesystem returned, and
+        // nothing here can tell a permanent refusal from a passing one. So
+        // this reports what happened and states the two conditions the
+        // operator can check for themselves, rather than asserting an outcome
+        // this code does not know.
+        `Could not release the lock on the secrets file at ${target} (${describeError(err)}). It may clear on its own \u2014 stale takeover reclaims a lock through the same directory removal, so it will not if whatever blocked this persists. If saves keep failing against this file and no other Inspector is running, remove ${lockPathOf(target)} by hand.`
+      );
+    }
+  };
+}
+async function withSecretFileLock(filePath, fn) {
+  const release = await openSecretFileLock(filePath);
+  if (release === null) return fn();
+  try {
+    return await fn();
+  } finally {
+    await release();
+  }
+}
+
+// ../../core/auth/node/file-secret-store.ts
+var scrypt2 = (passphrase, salt, keylen, options) => new Promise((resolve9, reject) => {
+  crypto2.scrypt(passphrase, salt, keylen, options, (err, key) => {
+    if (err) reject(err);
+    else resolve9(key);
+  });
+});
+var FORMAT_VERSION = 1;
+var CIPHER = "aes-256-gcm";
+var KEY_BYTES = 32;
+var IV_BYTES = 12;
+var GCM_TAG_BYTES = 16;
+var SCRYPT_N = 16384;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var SECRET_KEY_ENV = "MCP_INSPECTOR_SECRET_KEY";
+var buildAccount2 = (serverId, field) => `${serverId}:${field}`;
+function asSecretMap(value, filePath) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new SecretStoreUnavailableError(
+      `The secrets file at ${filePath} does not hold a secret map (found ${Array.isArray(value) ? "an array" : typeof value}). Refusing to write, which would replace it. Move the file aside to start over.`
+    );
+  }
+  for (const [key, entry] of Object.entries(value)) {
+    if (typeof entry !== "string") {
+      throw new SecretStoreUnavailableError(
+        `The secrets file at ${filePath} holds a non-string value for "${key}". Refusing to write, which would replace it. Move the file aside to start over.`
+      );
+    }
+  }
+  return { ...value };
+}
+var SecretFileKeyMismatchError = class extends SecretStoreUnavailableError {
+  constructor(filePath, hasKey) {
+    super(
+      hasKey ? `The secrets file at ${filePath} could not be decrypted with the current ${SECRET_KEY_ENV}. Refusing to write, which would overwrite the existing secrets. Restore the original passphrase, or delete the file to start over.` : `The secrets file at ${filePath} is encrypted but ${SECRET_KEY_ENV} is not set. Refusing to write, which would overwrite the existing secrets. Set the passphrase this file was written with, or delete the file to start over.`
+    );
+    this.name = "SecretFileKeyMismatchError";
+  }
+};
+var encodeParts = (iv, tag, body) => `${iv.toString("base64")}.${tag.toString("base64")}.${body.toString("base64")}`;
+function decodeParts(payload) {
+  const parts = payload.split(".");
+  if (parts.length !== 3) return null;
+  const [iv, tag, body] = parts;
+  return {
+    iv: Buffer.from(iv, "base64"),
+    tag: Buffer.from(tag, "base64"),
+    body: Buffer.from(body, "base64")
+  };
+}
+var MAX_WRITE_ATTEMPTS = 5;
+var fileQueues = /* @__PURE__ */ new Map();
+function sameMap(a, b) {
+  const ak = Object.keys(a);
+  if (ak.length !== Object.keys(b).length) return false;
+  return ak.every(
+    (k) => Object.prototype.hasOwnProperty.call(b, k) && a[k] === b[k]
+  );
+}
+var isPositiveInt = (v) => typeof v === "number" && Number.isInteger(v) && v > 0;
+function encryptedEnvelopeProblem(parsed) {
+  if (!parsed.kdf || typeof parsed.data !== "string") {
+    return "encrypted envelope is missing its kdf or data";
+  }
+  const parts = decodeParts(parsed.data);
+  if (!parts) return "encrypted payload is not iv.tag.ciphertext";
+  if (parts.iv.length !== IV_BYTES) {
+    return `initialization vector is ${parts.iv.length} bytes, expected ${IV_BYTES}`;
+  }
+  if (parts.tag.length !== GCM_TAG_BYTES) {
+    return `authentication tag is ${parts.tag.length} bytes, expected ${GCM_TAG_BYTES}`;
+  }
+  if (parts.body.length === 0) return "ciphertext is empty";
+  const { algorithm, salt, N, r, p } = parsed.kdf;
+  if (algorithm !== "scrypt") return `unsupported kdf "${String(algorithm)}"`;
+  if (typeof salt !== "string" || Buffer.from(salt, "base64").length === 0) {
+    return "kdf salt is missing or not base64";
+  }
+  if (!isPositiveInt(N) || N < 2 || (N & N - 1) !== 0) {
+    return `kdf N is ${String(N)}, which is not a power of two above 1`;
+  }
+  if (!isPositiveInt(r) || !isPositiveInt(p)) {
+    return `kdf r/p are ${String(r)}/${String(p)}, which are not positive integers`;
+  }
+  if (N > SCRYPT_N || r > SCRYPT_R || p > SCRYPT_P) {
+    return `kdf cost parameters (N=${N}, r=${r}, p=${p}) exceed the supported maximum (N=${SCRYPT_N}, r=${SCRYPT_R}, p=${SCRYPT_P})`;
+  }
+  return null;
+}
+var FileSecretStore = class {
+  filePath;
+  passphrase;
+  constructor(options) {
+    this.filePath = options.filePath;
+    const raw = options.passphrase ?? process.env[SECRET_KEY_ENV];
+    this.passphrase = raw && raw.trim() ? raw : void 0;
+  }
+  /**
+   * True when the *next write* will encrypt. This is the configured policy,
+   * not the state of the file — see {@link readOnDiskEncryption}, which is
+   * what the user-facing descriptor is built from.
+   */
+  get encrypted() {
+    return this.passphrase !== void 0;
+  }
+  /**
+   * What the file on disk is *currently* written as — `null` when there is
+   * no file yet, or when it cannot be read or parsed.
+   *
+   * Separate from {@link encrypted} because the two genuinely disagree for a
+   * whole session: adding `MCP_INSPECTOR_SECRET_KEY` to an install that
+   * already has a plaintext file flips `encrypted` to true immediately,
+   * while the bytes stay readable until the next `set`. A descriptor built
+   * from the policy would tell that user "File (encrypted)" while their
+   * existing secrets sat in the clear — the precise reassurance this whole
+   * subsystem exists not to give.
+   *
+   * Reads the envelope, and for an encrypted one **attempts to open it**.
+   * Structure alone is not access: a well-formed file this passphrase cannot
+   * decrypt answers `null` from every `get` and refuses every `set`, so
+   * reporting it as a healthy "encrypted" store hands the quiet footer to
+   * exactly the state the unreadable one exists to warn about. The
+   * authentication costs one scrypt derivation per call, which is once per
+   * `/api/config`, and the decrypted bytes are discarded.
+   *
+   * `absent` and `unreadable` are kept apart deliberately. Collapsing them
+   * (as a bare `null` did) means an existing file that is corrupt, or
+   * written in an envelope this build does not know, is reported as "no
+   * file yet" — and the descriptor then falls back to the configured write
+   * policy, so a passphrase-configured install claims "Encrypted file"
+   * about a file whose encryption state was never established and which
+   * `set` is in fact about to refuse.
+   */
+  async readOnDiskEncryption() {
+    let raw;
+    try {
+      raw = await readStoreFile(this.filePath);
+    } catch (err) {
+      return {
+        state: "unreadable",
+        detail: err instanceof Error ? err.message : String(err)
+      };
+    }
+    if (raw === null) return { state: "absent" };
+    try {
+      const parsed = JSON.parse(raw);
+      if (parsed.version !== FORMAT_VERSION) {
+        return {
+          state: "unreadable",
+          detail: `format version ${String(parsed.version)}, expected ${FORMAT_VERSION}`
+        };
+      }
+      if (parsed.encryption === "none") {
+        try {
+          asSecretMap(parsed.secrets ?? {}, this.filePath);
+        } catch (err) {
+          return {
+            state: "unreadable",
+            detail: err instanceof Error ? err.message : String(err)
+          };
+        }
+        return { state: "plaintext" };
+      }
+      if (parsed.encryption === CIPHER) {
+        const problem = encryptedEnvelopeProblem(parsed);
+        if (problem) return { state: "unreadable", detail: problem };
+        try {
+          await this.readMap();
+        } catch (err) {
+          return {
+            state: "unreadable",
+            detail: err instanceof SecretFileKeyMismatchError ? `it cannot be decrypted with the current ${SECRET_KEY_ENV}` : err instanceof Error ? err.message : String(err)
+          };
+        }
+        return { state: "encrypted" };
+      }
+      return {
+        state: "unreadable",
+        detail: `unsupported envelope (encryption="${String(parsed.encryption)}", version=${String(parsed.version)})`
+      };
+    } catch {
+      return { state: "unreadable", detail: "not valid JSON" };
+    }
+  }
+  async deriveKey(kdf) {
+    return scrypt2(
+      // Only reached when the passphrase is set — every caller checks first,
+      // which is what makes the non-null assertion safe here rather than a
+      // widened `string | undefined` threaded through the crypto helpers.
+      this.passphrase,
+      Buffer.from(kdf.salt, "base64"),
+      KEY_BYTES,
+      { N: kdf.N, r: kdf.r, p: kdf.p }
+    );
+  }
+  /**
+   * Read and decode the file into a plain map.
+   *
+   * Distinguishes three outcomes that callers treat differently: `null` for
+   * "no file yet" (a first write should create one), a map for success, and a
+   * throw for "there is a file and we cannot read it" — which must never be
+   * flattened into an empty map, or `set` would cheerfully overwrite it.
+   */
+  /**
+   * Every secret in the file, keyed by `${serverId}:${field}` — `null` when
+   * there is no file.
+   *
+   * Exists for one caller: the hand-off performed when a keychain becomes
+   * available on a box that had been falling back to a file (see
+   * `absorbFileSecretsIntoKeyring`). Nothing in the normal request path
+   * enumerates secrets, and deliberately so — this is the widest possible
+   * read of the store and it should stay a one-purpose seam rather than a
+   * general convenience.
+   *
+   * Throws for the same reasons `get` swallows: an unreadable or
+   * undecryptable file must not present as "no secrets", because the caller
+   * would conclude there was nothing to migrate and move on.
+   */
+  async readAll() {
+    return this.serialize(() => this.readMap());
+  }
+  async readMap() {
+    const raw = await readStoreFile(this.filePath);
+    if (raw === null) return null;
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (err) {
+      throw new SecretStoreUnavailableError(
+        `The secrets file at ${this.filePath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    if (parsed.version !== FORMAT_VERSION) {
+      throw new SecretStoreUnavailableError(
+        `The secrets file at ${this.filePath} declares format version ${String(parsed.version)}, but this Inspector only understands version ${FORMAT_VERSION}. It was probably written by a newer Inspector; upgrade, or move the file aside to start over.`
+      );
+    }
+    if (parsed.encryption === "none") {
+      return asSecretMap(parsed.secrets ?? {}, this.filePath);
+    }
+    if (parsed.encryption !== CIPHER || !parsed.kdf || !parsed.data) {
+      throw new SecretStoreUnavailableError(
+        `The secrets file at ${this.filePath} declares an unsupported format (encryption="${String(parsed.encryption)}", version=${String(parsed.version)}). It may have been written by a newer Inspector.`
+      );
+    }
+    if (!this.passphrase)
+      throw new SecretFileKeyMismatchError(this.filePath, false);
+    const structural = encryptedEnvelopeProblem(parsed);
+    if (structural) {
+      throw new SecretStoreUnavailableError(
+        `The secrets file at ${this.filePath} is not readable: ${structural}. Restoring a passphrase will not repair it; the file itself is malformed.`
+      );
+    }
+    const parts = decodeParts(parsed.data);
+    if (!parts) throw new SecretFileKeyMismatchError(this.filePath, true);
+    let plain;
+    try {
+      const key = await this.deriveKey(parsed.kdf);
+      const decipher = crypto2.createDecipheriv(CIPHER, key, parts.iv);
+      decipher.setAuthTag(parts.tag);
+      plain = Buffer.concat([
+        decipher.update(parts.body),
+        decipher.final()
+      ]).toString("utf-8");
+    } catch {
+      throw new SecretFileKeyMismatchError(this.filePath, true);
+    }
+    let payload;
+    try {
+      payload = JSON.parse(plain);
+    } catch (err) {
+      throw new SecretStoreUnavailableError(
+        `The secrets file at ${this.filePath} decrypted successfully but its contents are not valid JSON: ${err instanceof Error ? err.message : String(err)}. The passphrase is correct; the file itself is corrupt.`
+      );
+    }
+    return asSecretMap(payload, this.filePath);
+  }
+  async writeMap(map) {
+    let file;
+    if (this.passphrase) {
+      const kdf = {
+        algorithm: "scrypt",
+        // A fresh salt per write, not per file: rewriting with the same salt
+        // and a fresh IV would still be safe for GCM, but re-salting costs one
+        // scrypt derivation we were doing anyway and removes the question.
+        salt: crypto2.randomBytes(16).toString("base64"),
+        N: SCRYPT_N,
+        r: SCRYPT_R,
+        p: SCRYPT_P
+      };
+      const key = await this.deriveKey(kdf);
+      const iv = crypto2.randomBytes(IV_BYTES);
+      const cipher = crypto2.createCipheriv(CIPHER, key, iv);
+      const body = Buffer.concat([
+        cipher.update(JSON.stringify(map), "utf-8"),
+        cipher.final()
+      ]);
+      file = {
+        version: FORMAT_VERSION,
+        encryption: CIPHER,
+        kdf,
+        data: encodeParts(iv, cipher.getAuthTag(), body)
+      };
+    } else {
+      file = { version: FORMAT_VERSION, encryption: "none", secrets: map };
+    }
+    await writeStoreFile(this.filePath, `${JSON.stringify(file, null, 2)}
+`);
+  }
+  /**
+   * Apply a mutation to the file, under a cross-process lock, and confirm it
+   * survived.
+   *
+   * **Two mechanisms, and they answer different questions** — this is not
+   * belt-and-braces.
+   *
+   * The lock ({@link withSecretFileLock}, #2082) is the one that provides
+   * mutual exclusion: a durable secrets file is shared state, and a second
+   * Inspector on the same box — a CLI run beside a web session is the
+   * ordinary case, not a contrived one — otherwise reads the same "before"
+   * map and then atomically replaces the file, dropping whatever the first
+   * process had just added. Both writes report success; one secret is simply
+   * gone. Held across the read *and* the write, so no other holder can
+   * observe or replace the map in between.
+   *
+   * The verify covers what a lock structurally cannot. A lock is an advisory
+   * convention between the processes that take it, so it says nothing about
+   * a writer that does not: an editor, a restored backup, a `jq` one-liner,
+   * or an Inspector predating #2082. It is also the fallback when the lock
+   * is unavailable at all — `withSecretFileLock` runs the body anyway on a
+   * read-only or lock-hostile directory rather than failing a `set` on
+   * exactly the deployments this store exists for (#1848, #1905).
+   *
+   * So: read `M0`, apply the mutation to get `M1`, write it, then read back
+   * `M2`. If `M2` equals `M1` nothing interleaved. If it does not, someone
+   * wrote between our write and our read — so re-apply onto what they left
+   * and try again.
+   *
+   * The comparison is over the **whole map**, not just the entry we touched.
+   * Checking only our own key would pass in precisely the case that loses
+   * data: our entry is present, and it is the *other* writer's that is gone.
+   * When the verify does fire, the writer that was clobbered is the one that
+   * repairs it — A writes `MA`, B writes `MB` over it, B verifies `MB`
+   * correctly, A verifies, sees `M2 !== MA`, re-applies onto `MB`.
+   *
+   * **What is left, stated without overselling.** Against an unlocked writer
+   * the verify is not mutual exclusion: it only catches a clobber that has
+   * already landed, so ordering the two as write-A, verify-A, write-B,
+   * verify-B loses A's entry with both reporting success. That residual is
+   * now confined to a writer outside this codebase, or to a directory where
+   * no lock could be taken — and the latter announces itself, once, on the
+   * console.
+   *
+   * Reads deliberately do not participate: `writeStoreFile` is atomic
+   * (write-temp-then-rename), so a reader sees either the old file or the
+   * new one, never a torn one. Taking the lock for them would serialize
+   * every `GET /api/servers` behind whatever else holds it, to prevent
+   * nothing.
+   */
+  async mutate(apply) {
+    await withSecretFileLock(this.filePath, () => this.mutateLocked(apply));
+  }
+  /** {@link mutate}'s body, with the lock already held. */
+  async mutateLocked(apply) {
+    for (let attempt = 0; attempt < MAX_WRITE_ATTEMPTS; attempt++) {
+      let current;
+      try {
+        current = await this.readMap() ?? {};
+      } catch (err) {
+        if (err instanceof SecretStoreUnavailableError) throw err;
+        throw new SecretStoreUnavailableError(
+          `Could not read the secrets file at ${this.filePath}: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+      const next = apply(current);
+      if (next === null) return;
+      try {
+        await this.writeMap(next);
+      } catch (err) {
+        throw new SecretStoreUnavailableError(
+          `Could not write the secrets file at ${this.filePath}: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+      let observed;
+      try {
+        observed = await this.readMap() ?? {};
+      } catch {
+        continue;
+      }
+      if (sameMap(next, observed)) return;
+    }
+    throw new SecretStoreUnavailableError(
+      `Could not write the secrets file at ${this.filePath}: another process kept overwriting it (gave up after ${MAX_WRITE_ATTEMPTS} attempts). Its secrets are intact; the value you just entered was not saved.`
+    );
+  }
+  /**
+   * Run `fn` with the file to itself, so concurrent callers can't lose
+   * writes.
+   *
+   * Keyed on the **resolved path, process-wide** rather than on this
+   * instance. Two `FileSecretStore`s pointing at one file are ordinary —
+   * the resolved store holds one and `absorbFileSecretsIntoKeyring`
+   * constructs another — and a per-instance queue does not order them
+   * against each other at all. They then race in-process, which the
+   * optimistic verify is only *supposed* to catch for writers in different
+   * processes: both read the same map, both write, and whichever verifies
+   * before the other's write lands sees its own value and returns happy.
+   * Measured, not theorised — two instances racing `set` lost an entry on
+   * the first run of the convergence test below.
+   *
+   * So the in-process case is made correct by construction here, and
+   * {@link mutate}'s cross-process lock covers what this cannot see: a
+   * second Inspector process.
+   *
+   * The queue is *also* what keeps that lock usable. `proper-lockfile` is
+   * not reentrant — a second `lock()` on a path this process already holds
+   * fails `ELOCKED`, which is indistinguishable from a genuine remote
+   * holder. Serializing here means the lock is only ever contended between
+   * processes, which is the only contention it is asked to arbitrate.
+   */
+  serialize(fn) {
+    const key = path3.resolve(this.filePath);
+    const run = (fileQueues.get(key) ?? Promise.resolve()).then(fn);
+    const settled = run.then(
+      () => {
+      },
+      () => {
+      }
+    );
+    fileQueues.set(key, settled);
+    void settled.then(() => {
+      if (fileQueues.get(key) === settled) fileQueues.delete(key);
+    });
+    return run;
+  }
+  /**
+   * One read and one derivation for an entire rehydration.
+   *
+   * `get` reads and decrypts the whole file, so the cost is per *call*, not
+   * per field — which is why the batch has to span servers. A per-server
+   * version of this shipped first and left a 20-server catalog paying 20
+   * serialized derivations, the same stall it was written to remove.
+   * Tolerant like `get`: an unreadable store yields no fields for anyone
+   * rather than throwing.
+   */
+  async getMany(requests) {
+    let map;
+    try {
+      map = await this.serialize(() => this.readMap());
+    } catch {
+      map = null;
+    }
+    const out = {};
+    for (const { serverId, fields } of requests) {
+      const found = {};
+      for (const field of fields) {
+        const value = map?.[buildAccount2(serverId, field)];
+        if (value !== void 0) found[field] = value;
+      }
+      out[serverId] = found;
+    }
+    return out;
+  }
+  /**
+   * The intolerant read — same lookup as {@link get}, minus the catch.
+   *
+   * Without this, `secretStoreGetStrict` fell back to `get` for the file
+   * store and turned every read failure into `null`. Both plaintext
+   * migrations *write* on `null` and then strip the disk copy, so a
+   * transient read error that cleared before the write let an older
+   * on-disk value replace a newer stored one — the same inversion the
+   * strict seam was introduced to prevent, still open on the store the
+   * seam was introduced for.
+   */
+  async getStrict(serverId, field) {
+    try {
+      const map = await this.serialize(() => this.readMap());
+      return map?.[buildAccount2(serverId, field)] ?? null;
+    } catch (err) {
+      if (err instanceof SecretStoreUnavailableError) throw err;
+      throw new SecretStoreUnavailableError(
+        `Could not read the secrets file at ${this.filePath}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  async get(serverId, field) {
+    try {
+      const map = await this.serialize(() => this.readMap());
+      return map?.[buildAccount2(serverId, field)] ?? null;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * One read-modify-write-verify cycle for a whole server's fields.
+   *
+   * `set` pays that cycle — and, encrypted, three scrypt derivations — per
+   * call, serialized behind this store's queue. The settings form resends a
+   * server's full `env` map on any edit, so a 10-variable stdio server spent
+   * ~30 derivations saving an unrelated timeout change.
+   */
+  async setMany(serverId, values) {
+    if (Object.keys(values).length === 0) return;
+    await this.serialize(
+      () => this.mutate((map) => {
+        const next = { ...map };
+        for (const [field, value] of Object.entries(values)) {
+          next[buildAccount2(serverId, field)] = value;
+        }
+        return next;
+      })
+    );
+  }
+  async set(serverId, field, value) {
+    await this.serialize(
+      () => this.mutate((map) => ({
+        ...map,
+        [buildAccount2(serverId, field)]: value
+      }))
+    );
+  }
+  async delete(serverId, field) {
+    await this.deleteWhere((key) => key === buildAccount2(serverId, field));
+  }
+  async deleteAllForServer(serverId) {
+    const prefix = `${serverId}:`;
+    await this.deleteWhere((key) => key.startsWith(prefix));
+  }
+  /**
+   * Shared delete body. Silent on every failure, matching the keyring store:
+   * every reason a delete can fail collapses to "the entry isn't there
+   * anymore", and `set` is the operation that reports a broken store.
+   */
+  async deleteWhere(match) {
+    try {
+      await this.serialize(
+        () => this.mutate((map) => {
+          const keys = Object.keys(map).filter(match);
+          if (keys.length === 0) return null;
+          const next = { ...map };
+          for (const key of keys) delete next[key];
+          return next;
+        })
+      );
+    } catch {
+    }
+  }
+};
+async function tightenSecretFilePermissions(filePath) {
+  try {
+    await fs3.chmod(filePath, 384);
+  } catch {
+  }
+  return readSecretFilePermissions(filePath);
+}
+async function readSecretFilePermissions(filePath) {
+  try {
+    if (process.platform === "win32") {
+      await fs3.stat(filePath);
+      return { state: "unknown", detail: "not checked on Windows" };
+    }
+    const mode = (await fs3.stat(filePath)).mode & 511;
+    if (mode === 384) return { state: "ok" };
+    return { state: "loose", mode };
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      return { state: "absent" };
+    }
+    return { state: "unknown", detail: code ?? "unknown error" };
+  }
+}
+
+// ../../core/auth/node/secret-store-selection.ts
+var SECRET_STORE_ENV = "MCP_INSPECTOR_SECRET_STORE";
+var SECRET_FILE_ENV = "MCP_INSPECTOR_SECRET_FILE";
+var STORAGE_DIR_ENV = "MCP_STORAGE_DIR";
+var KINDS = ["keyring", "file", "memory"];
+function parseSecretStoreEnv(raw) {
+  const value = raw?.trim().toLowerCase();
+  if (!value) return void 0;
+  if (KINDS.includes(value)) return value;
+  console.warn(
+    `[mcp-inspector] Ignoring ${SECRET_STORE_ENV}="${raw}": expected one of ${KINDS.join(", ")}.`
+  );
+  return void 0;
+}
+function defaultSecretFilePath() {
+  const override = process.env[SECRET_FILE_ENV]?.trim();
+  if (override) return path4.resolve(override);
+  const storageDir = process.env[STORAGE_DIR_ENV]?.trim();
+  if (storageDir) return path4.resolve(storageDir, "secrets.json");
+  const homeDir = process.env.HOME || process.env.USERPROFILE || ".";
+  return path4.resolve(homeDir, ".mcp-inspector", "secrets.json");
+}
+function isContainer() {
+  if (process.env.KUBERNETES_SERVICE_HOST) return true;
+  try {
+    if (fsSync.existsSync("/.dockerenv") || fsSync.existsSync("/run/.containerenv")) {
+      return true;
+    }
+  } catch {
+  }
+  try {
+    const cgroup = fsSync.readFileSync("/proc/1/cgroup", "utf-8");
+    return /\b(docker|containerd|kubepods|podman|libpod|lxc)\b/.test(cgroup);
+  } catch {
+    return false;
+  }
+}
+function nearestExisting(dir) {
+  let current = path4.resolve(dir);
+  while (!fsSync.existsSync(current)) {
+    const parent = path4.dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+  return current;
+}
+function unescapeMountPoint(point) {
+  return point.replace(
+    /\\(\d{3})/g,
+    (_match, octal) => String.fromCharCode(parseInt(octal, 8))
+  );
+}
+var EPHEMERAL_FSTYPES = /* @__PURE__ */ new Set(["tmpfs", "ramfs"]);
+function readMountPoints() {
+  try {
+    return fsSync.readFileSync("/proc/self/mountinfo", "utf-8").split("\n").flatMap((line) => {
+      const point = line.split(" ")[4];
+      if (!point) return [];
+      const after = line.split(" - ")[1];
+      const fstype = after?.trim().split(/\s+/)[0];
+      if (fstype && EPHEMERAL_FSTYPES.has(fstype)) return [];
+      return [unescapeMountPoint(point)];
+    }).filter((point) => point !== "/");
+  } catch {
+    return null;
   }
-};
-var checkKeyringShape = (mod) => {
+}
+function isOnMountPoint(dir) {
   try {
-    if (typeof mod.AsyncEntry === "function" && typeof mod.findCredentialsAsync === "function") {
-      return { ok: true, mod };
+    const nearest = nearestExisting(dir);
+    if (nearest === null) return false;
+    let current = nearest;
+    try {
+      current = fsSync.realpathSync(nearest);
+    } catch {
+    }
+    const mounts = readMountPoints();
+    if (mounts !== null) {
+      return mounts.some(
+        (point) => current === point || current.startsWith(`${point}/`)
+      );
     }
+    const parent = path4.dirname(current);
+    if (parent === current) return false;
+    return fsSync.statSync(current).dev !== fsSync.statSync("/").dev;
+  } catch {
+    return false;
+  }
+}
+async function buildStore(kind, reason, detail) {
+  if (kind === "keyring") {
     return {
-      ok: false,
-      err: new KeyringModuleShapeError(
-        "did not expose AsyncEntry / findCredentialsAsync"
-      )
+      store: new KeyringSecretStore(),
+      info: { kind, reason, durable: true }
     };
-  } catch (err) {
+  }
+  if (kind === "memory") {
     return {
-      ok: false,
-      err: new KeyringModuleShapeError(
-        `its exports could not be read: ${err instanceof Error ? err.message : String(err)}`,
-        { cause: err }
-      )
+      store: new SessionSecretStore(),
+      info: { kind, reason, durable: false, detail }
     };
   }
-};
-var loadKeyring = () => {
-  keyringLoad ??= import("@napi-rs/keyring").then(
-    checkKeyringShape,
-    (err) => ({ ok: false, err })
-  );
-  return keyringLoad;
-};
-function parseAccount(account) {
-  const idx = account.indexOf(":");
-  if (idx <= 0 || idx === account.length - 1) return null;
+  const filePath = defaultSecretFilePath();
+  const store = new FileSecretStore({ filePath });
+  await tightenSecretFilePermissions(filePath);
   return {
-    serverId: account.slice(0, idx),
-    field: account.slice(idx + 1)
+    store,
+    info: await describeFileStore(store, filePath, kind, reason, detail)
   };
 }
-var buildAccount = (serverId, field) => `${serverId}:${field}`;
-var KeychainUnavailableError = class extends Error {
-  constructor(cause) {
-    const message = cause instanceof Error ? cause.message : String(cause);
-    super(
-      `OS keychain is not available. ${hintFor(cause, message)} Underlying error: ${message}`
+async function describeFileStore(store, filePath, kind, reason, detail) {
+  const onDisk = await store.readOnDiskEncryption();
+  const unreadable = onDisk.state === "unreadable" ? onDisk.detail : void 0;
+  const plaintext = onDisk.state === "absent" ? !store.encrypted : onDisk.state === "plaintext";
+  const perms = await readSecretFilePermissions(filePath);
+  return {
+    kind,
+    reason,
+    path: filePath,
+    // Omitted entirely when the envelope could not be read, so no consumer
+    // can read a default out of it.
+    ...unreadable === void 0 ? { plaintext } : {},
+    ...unreadable !== void 0 ? { encryptionUnknown: unreadable } : {},
+    ...perms.state === "loose" ? { looseMode: perms.mode } : {},
+    ...perms.state === "unknown" ? { permissionsUnknown: perms.detail } : {},
+    // Only meaningful while the two disagree; omitted otherwise so the
+    // payload does not carry a flag that says nothing.
+    ...unreadable === void 0 && plaintext && store.encrypted ? { pendingEncryption: true } : {},
+    durable: true,
+    detail
+  };
+}
+function chooseFallbackKind(opts) {
+  return opts.container && !opts.mounted ? "memory" : "file";
+}
+function warnAboutSecretStorage(info) {
+  if (info.reason === "fallback") {
+    console.warn(
+      `
+[mcp-inspector] The OS keychain is not available, so secrets will be kept in: ${secretStorageSummary(info)}.` + (info.detail ? `
+[mcp-inspector] Keychain error: ${info.detail}` : "") + `
+[mcp-inspector] Set ${SECRET_STORE_ENV}=keyring|file|memory to choose explicitly.`
     );
-    this.name = "KeychainUnavailableError";
-  }
-};
-var hintFor = (cause, message) => {
-  if (cause instanceof KeyringModuleShapeError) {
-    return `The @napi-rs/keyring package loaded but does not expose the API this build expects \u2014 most likely a version or packaging mismatch; reinstall the Inspector, and report this if it persists.`;
   }
-  if (message.includes("Cannot find native binding")) {
-    return `The @napi-rs/keyring platform package for this OS is missing or unavailable \u2014 reinstall the Inspector (for npx, clear the npx cache under your npm cache directory first).`;
-  }
-  return `On Linux, install libsecret / gnome-keyring.`;
-};
-var KeyringSecretStore = class {
-  async get(serverId, field) {
+  const caveat = secretStorageCaveat(info);
+  if (caveat) console.warn(`[mcp-inspector] ${caveat}`);
+}
+var resolved;
+function resolveSecretStore() {
+  resolved ??= (async () => {
+    const configured = parseSecretStoreEnv(process.env[SECRET_STORE_ENV]);
+    if (configured) {
+      const result2 = await buildStore(configured, "configured");
+      if (configured === "keyring") {
+        await absorbFileSecretsIntoKeyring(result2.store);
+      }
+      warnAboutSecretStorage(result2.info);
+      return result2;
+    }
+    const probe = await probeKeyringAvailable();
+    if (probe.available) {
+      const result2 = await buildStore("keyring", "default");
+      await absorbFileSecretsIntoKeyring(result2.store);
+      return result2;
+    }
+    const kind = chooseFallbackKind({
+      container: isContainer(),
+      mounted: isOnMountPoint(path4.dirname(defaultSecretFilePath()))
+    });
+    const result = await buildStore(kind, "fallback", probe.detail);
+    warnAboutSecretStorage(result.info);
+    return result;
+  })();
+  return resolved;
+}
+async function absorbFileSecretsIntoKeyring(keyring) {
+  const filePath = defaultSecretFilePath();
+  if (!await anythingToMigrate(filePath)) return;
+  const claimed = await withSecretFileLock(filePath, async () => {
+    await recoverOrphanedSnapshots(filePath);
+    if (!fsSync.existsSync(filePath)) return null;
+    const staged = `${filePath}.migrating-${process.pid}-${randomUUID()}`;
     try {
-      const keyring = await loadKeyring();
-      if (!keyring.ok) return null;
-      const entry = new keyring.mod.AsyncEntry(
-        SERVICE_NAME,
-        buildAccount(serverId, field)
-      );
-      const v = await entry.getPassword();
-      return v ?? null;
-    } catch {
+      await fs4.rename(filePath, staged);
+    } catch (err) {
+      const code = err.code;
+      if (code !== "ENOENT") {
+        console.warn(
+          `
+[mcp-inspector] Could not claim the secrets file at ${filePath} for migration into the OS keychain (${code ?? "unknown error"}), so it has been left in place. Its secrets are not visible to this session.`
+        );
+      }
       return null;
     }
+    const releaseSnapshot = await openSecretFileLock(staged).catch(() => null);
+    return { staged, releaseSnapshot };
+  }).catch((err) => {
+    console.warn(
+      `
+[mcp-inspector] Could not lock the secrets file at ${filePath} to migrate it into the OS keychain (${err.message}), so it has been left in place. Its secrets are not visible to this session; the next run will try again.`
+    );
+    return null;
+  });
+  if (claimed === null) return;
+  try {
+    await handOffStagedSecrets(claimed.staged, filePath, keyring);
+  } finally {
+    await claimed.releaseSnapshot?.();
   }
-  async set(serverId, field, value) {
+}
+async function handOffStagedSecrets(staged, filePath, keyring) {
+  const file = new FileSecretStore({ filePath: staged });
+  const absorbed = await handOff(file, staged, keyring);
+  if (absorbed) {
     try {
-      const keyring = await loadKeyring();
-      if (!keyring.ok) throw new KeychainUnavailableError(keyring.err);
-      const entry = new keyring.mod.AsyncEntry(
-        SERVICE_NAME,
-        buildAccount(serverId, field)
+      await fs4.rm(staged, { force: true });
+      console.warn(
+        `
+[mcp-inspector] The OS keychain is available again. Secrets kept in ${filePath} while it was not have been moved into the keychain, and the file has been removed.`
       );
-      await entry.setPassword(value);
     } catch (err) {
-      if (err instanceof KeychainUnavailableError) throw err;
-      throw new KeychainUnavailableError(err);
+      console.warn(
+        `
+[mcp-inspector] Secrets were moved into the OS keychain, but the temporary copy at ${staged} could not be removed (${err instanceof Error ? err.message : String(err)}). Delete it once you have confirmed the keychain has your secrets.`
+      );
     }
+    return;
   }
-  async delete(serverId, field) {
+  try {
+    await fs4.link(staged, filePath);
+    await fs4.rm(staged, { force: true });
+  } catch {
+    console.warn(
+      `
+[mcp-inspector] Could not restore ${staged} to ${filePath}; both files exist and the snapshot holds the secrets that were not migrated. Merge it by hand, or delete it once you have confirmed nothing is missing.`
+    );
+  }
+}
+var isSnapshotName = (name, base) => name.startsWith(`${base}.migrating-`) && !name.endsWith(".lock");
+async function anythingToMigrate(filePath) {
+  const base = path4.basename(filePath);
+  try {
+    return (await fs4.readdir(path4.dirname(filePath))).some(
+      (name) => name === base || isSnapshotName(name, base)
+    );
+  } catch (err) {
+    const code = err.code;
+    return code !== "ENOENT" && code !== "ENOTDIR";
+  }
+}
+async function recoverOrphanedSnapshots(filePath) {
+  const dir = path4.dirname(filePath);
+  const base = path4.basename(filePath);
+  let names;
+  try {
+    names = (await fs4.readdir(dir)).filter((n) => isSnapshotName(n, base));
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    const orphan = path4.join(dir, name);
+    if (await isFileLockHeld(orphan)) continue;
     try {
-      const keyring = await loadKeyring();
-      if (!keyring.ok) return;
-      const entry = new keyring.mod.AsyncEntry(
-        SERVICE_NAME,
-        buildAccount(serverId, field)
+      await fs4.link(orphan, filePath);
+      await fs4.rm(orphan, { force: true });
+      console.warn(
+        `
+[mcp-inspector] Recovered secrets left behind by an interrupted migration (${orphan} \u2192 ${filePath}).`
       );
-      await entry.deleteCredential();
     } catch {
+      console.warn(
+        `
+[mcp-inspector] Found secrets from an interrupted migration at ${orphan}, and a current ${filePath} already exists, so it was left alone. It may hold values the current file does not.`
+      );
     }
   }
-  async deleteAllForServer(serverId) {
-    let creds;
-    try {
-      const keyring = await loadKeyring();
-      if (!keyring.ok) return;
-      creds = await keyring.mod.findCredentialsAsync(SERVICE_NAME);
-    } catch {
-      return;
-    }
-    const prefix = `${serverId}:`;
-    for (const c of creds) {
-      if (!c.account.startsWith(prefix)) continue;
-      const parsed = parseAccount(c.account);
-      if (!parsed || parsed.serverId !== serverId) continue;
-      await this.delete(serverId, parsed.field);
+}
+async function handOff(file, filePath, keyring) {
+  let entries;
+  try {
+    entries = await file.readAll();
+  } catch (err) {
+    console.warn(
+      `
+[mcp-inspector] The OS keychain is available again, but the secrets file at ${filePath} could not be read, so its contents were left there: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return false;
+  }
+  if (!entries || Object.keys(entries).length === 0) return false;
+  let complete = true;
+  try {
+    for (const [account, value] of Object.entries(entries)) {
+      const parsed = parseAccount(account);
+      if (!parsed) {
+        complete = false;
+        continue;
+      }
+      const existing = await secretStoreGetStrict(
+        keyring,
+        parsed.serverId,
+        parsed.field
+      );
+      if (existing === null) {
+        await keyring.set(parsed.serverId, parsed.field, value);
+      }
     }
+  } catch (err) {
+    console.warn(
+      `
+[mcp-inspector] Could not move the secrets file at ${filePath} into the OS keychain, so it has been left in place: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return false;
+  }
+  if (!complete) {
+    console.warn(
+      `
+[mcp-inspector] Secrets from ${filePath} have been copied into the OS keychain, but at least one entry could not be read (its key is not in \`serverId:field\` form). The file has been left in place so nothing is lost.`
+    );
+    return false;
+  }
+  return true;
+}
+async function getSecretStorageInfo() {
+  const { store, info } = await resolveSecretStore();
+  if (info.kind !== "file" || !(store instanceof FileSecretStore)) return info;
+  return describeFileStore(
+    store,
+    store.filePath,
+    "file",
+    info.reason,
+    info.detail
+  );
+}
+var DeferredSecretStore = class {
+  async target() {
+    return (await resolveSecretStore()).store;
+  }
+  async isDurable() {
+    return secretStoreIsDurable(await this.target());
+  }
+  /**
+   * Forwarded, and its absence was a real defect rather than an omission:
+   * this is the store production actually uses, so a `secretStoreGetStrict`
+   * call against it fell through to the tolerant `get` and the strictness
+   * existed only in tests that injected a concrete store.
+   */
+  async getStrict(serverId, field) {
+    return secretStoreGetStrict(await this.target(), serverId, field);
+  }
+  async getMany(requests) {
+    return secretStoreGetMany(await this.target(), requests);
+  }
+  async get(serverId, field) {
+    return (await this.target()).get(serverId, field);
+  }
+  async set(serverId, field, value) {
+    await (await this.target()).set(serverId, field, value);
+  }
+  async setMany(serverId, values) {
+    await secretStoreSetMany(await this.target(), serverId, values);
+  }
+  async delete(serverId, field) {
+    await (await this.target()).delete(serverId, field);
+  }
+  async deleteAllForServer(serverId) {
+    await (await this.target()).deleteAllForServer(serverId);
   }
 };
+function defaultSecretStore() {
+  return new DeferredSecretStore();
+}
 
 // ../../core/client/config-parse.ts
 import { z } from "zod";
@@ -2261,7 +3970,8 @@ async function migrateClientPlaintextSecret(filePath, config, secretStore) {
   const value = secrets[SECRET_FIELD_IDP_CLIENT_SECRET];
   if (!value) return config;
   try {
-    const existing = await secretStore.get(
+    const existing = await secretStoreGetStrict(
+      secretStore,
       CLIENT_KEYCHAIN_ID,
       SECRET_FIELD_IDP_CLIENT_SECRET
     );
@@ -2272,10 +3982,11 @@ async function migrateClientPlaintextSecret(filePath, config, secretStore) {
         value
       );
     }
+    if (!await secretStoreIsDurable(secretStore)) return config;
     await writeStoreFile(filePath, serializeStore(stripped));
     return stripped;
   } catch (err) {
-    if (err instanceof KeychainUnavailableError) {
+    if (err instanceof SecretStoreUnavailableError) {
       return config;
     }
     throw err;
@@ -2309,7 +4020,30 @@ async function writeClientConfigStore(filePath, body, secretStore) {
       SECRET_FIELD_IDP_CLIENT_SECRET
     );
   }
-  await writeStoreFile(filePath, serializeStore(stripped));
+  const durable = await secretStoreIsDurable(secretStore);
+  await writeStoreFile(
+    filePath,
+    serializeStore(
+      durable ? stripped : await preserveLegacyPlaintext(
+        filePath,
+        validated,
+        stripped,
+        idpSecret
+      )
+    )
+  );
+}
+async function preserveLegacyPlaintext(filePath, validated, stripped, idpSecret) {
+  if (!idpSecret) return stripped;
+  try {
+    const raw = await readStoreFile(filePath);
+    if (raw === null) return stripped;
+    const prior = parseClientConfig(parseStore(raw));
+    const priorSecret = extractSecretsFromClientConfig(prior).secrets[SECRET_FIELD_IDP_CLIENT_SECRET];
+    return priorSecret === idpSecret ? validated : stripped;
+  } catch {
+    return stripped;
+  }
 }
 async function deleteClientConfigStore(filePath, secretStore) {
   await deleteStoreFile(filePath);
@@ -2319,6 +4053,30 @@ async function deleteClientConfigStore(filePath, secretStore) {
 // ../../core/mcp/remote/node/server.ts
 import { ZodError as ZodError2 } from "zod";
 var SSE_PRIMING_COMMENT = ":\n\n";
+function closeAbortedStream(stream) {
+  stream.close().catch(() => {
+  });
+}
+async function primeAndHoldSseStream(stream, cleanup) {
+  let done = false;
+  const aborted = new Promise((resolve9) => {
+    stream.onAbort(() => {
+      if (done) return;
+      done = true;
+      cleanup();
+      closeAbortedStream(stream);
+      resolve9();
+    });
+  });
+  await stream.write(SSE_PRIMING_COMMENT);
+  await aborted;
+}
+var MAX_APP_DOCUMENT_CHARS = 8 * 1024 * 1024;
+var MAX_APP_DOCUMENT_BODY_BYTES = 24 * 1024 * 1024;
+var MAX_APP_CSP_CHARS = 8 * 1024;
+function isHeaderSafeValue(value) {
+  return !/[^\t\x20-\x7e]/.test(value);
+}
 function createOriginMiddleware(allowedOrigins) {
   return async (c, next) => {
     if (!allowedOrigins || allowedOrigins.length === 0) {
@@ -2453,13 +4211,13 @@ function mcpParamHeadersOnly(headers) {
 }
 function createRemoteApp(options) {
   const dangerouslyOmitAuth = !!options.dangerouslyOmitAuth;
-  const authToken = dangerouslyOmitAuth ? "" : options.authToken || process.env[API_SERVER_ENV_VARS.AUTH_TOKEN] || randomBytes(32).toString("hex");
+  const authToken = dangerouslyOmitAuth ? "" : options.authToken || process.env[API_SERVER_ENV_VARS.AUTH_TOKEN] || randomBytes3(32).toString("hex");
   const app = new Hono();
   const sessions = /* @__PURE__ */ new Map();
   const { logger: fileLogger, allowedOrigins } = options;
   const storageDir = options.storageDir ?? getDefaultStorageDir();
   const mcpConfigPath = options.mcpConfigPath ?? getDefaultMcpConfigPath();
-  const secretStore = options.secretStore ?? new KeyringSecretStore();
+  const secretStore = options.secretStore ?? defaultSecretStore();
   const writable = options.writable ?? true;
   const inMemoryServers = options.initialServers;
   const watchable = !inMemoryServers;
@@ -2543,14 +4301,66 @@ function createRemoteApp(options) {
   if (!dangerouslyOmitAuth) {
     app.use("*", createAuthMiddleware(authToken));
   }
-  app.get("/api/config", (c) => {
+  app.get("/api/config", async (c) => {
+    const secretStorage = options.secretStorageResolver ? await options.secretStorageResolver() : options.initialConfig?.secretStorage;
     const payload = {
       ...options.initialConfig,
       writable,
+      // Assigned unconditionally, not spread-when-truthy. The resolver's
+      // contract is that `undefined` means "not known right now", and a
+      // conditional spread leaves the *startup* descriptor from
+      // `initialConfig` standing in its place — so a store that became
+      // undescribable would keep serving a stale, confident answer. Setting
+      // it to `undefined` is what clears it; `c.json` omits the key.
+      secretStorage,
       ...options.sandboxUrl ? { sandboxUrl: options.sandboxUrl } : {}
     };
     return c.json(payload);
   });
+  app.post(
+    "/api/app-document",
+    // Before the parse, not after: see MAX_APP_DOCUMENT_BODY_BYTES.
+    bodyLimit({
+      maxSize: MAX_APP_DOCUMENT_BODY_BYTES,
+      onError: (c) => c.json({ error: "Document too large" }, 413)
+    }),
+    async (c) => {
+      const publish = options.publishAppDocument;
+      if (!publish) {
+        return c.json({ error: "App-origin hosting is not available" }, 503);
+      }
+      let parsed;
+      try {
+        parsed = await c.req.json();
+      } catch {
+        return c.json({ error: "Invalid JSON body" }, 400);
+      }
+      if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return c.json({ error: "Invalid JSON body" }, 400);
+      }
+      const { html, csp } = parsed;
+      if (typeof html !== "string" || html === "") {
+        return c.json({ error: "Missing html" }, 400);
+      }
+      if (csp !== void 0 && typeof csp !== "string") {
+        return c.json({ error: "csp must be a string" }, 400);
+      }
+      if (csp !== void 0 && !isHeaderSafeValue(csp)) {
+        return c.json({ error: "csp is not a valid header value" }, 400);
+      }
+      if (html.length > MAX_APP_DOCUMENT_CHARS) {
+        return c.json({ error: "Document too large" }, 413);
+      }
+      if (csp !== void 0 && csp.length > MAX_APP_CSP_CHARS) {
+        return c.json({ error: "csp too large" }, 413);
+      }
+      const published = publish({ html, csp });
+      if (!published) {
+        return c.json({ error: "App-origin hosting is not available" }, 503);
+      }
+      return c.json(published);
+    }
+  );
   app.post("/api/mcp/connect", async (c) => {
     let body;
     try {
@@ -2725,24 +4535,17 @@ function createRemoteApp(options) {
         });
       });
       if (session.isTransportDead()) {
-        await new Promise((resolve6) => setTimeout(resolve6, 0));
+        await new Promise((resolve9) => setTimeout(resolve9, 0));
         session.clearEventConsumer();
         sessions.delete(sessionId);
         return;
       }
-      await stream.write(SSE_PRIMING_COMMENT);
-      stream.onAbort(() => {
+      await primeAndHoldSseStream(stream, () => {
         const shouldCleanup = session.clearEventConsumer();
-        stream.close();
         if (shouldCleanup || session.isTransportDead()) {
           sessions.delete(sessionId);
         }
       });
-      await new Promise((resolve6) => {
-        stream.onAbort(() => {
-          resolve6();
-        });
-      });
     });
   });
   app.post("/api/mcp/disconnect", async (c) => {
@@ -2803,7 +4606,7 @@ function createRemoteApp(options) {
       return c.json({ error: "Missing url" }, 400);
     }
     try {
-      const res = await fetch(url, {
+      const res = await (createProxyFetch() ?? fetch)(url, {
         method,
         headers: new Headers(headers),
         body: reqBody
@@ -2914,6 +4717,7 @@ function createRemoteApp(options) {
       console.warn("[mcp.json]", msg, bindings);
     }
   };
+  const isJsonObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
   const isStringRecord = (v) => {
     if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
     for (const val of Object.values(v)) {
@@ -2930,12 +4734,27 @@ function createRemoteApp(options) {
   const isOauthObject = (v) => {
     if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
     const o = v;
-    for (const k of ["clientId", "clientSecret", "scopes"]) {
+    for (const k of [
+      "clientId",
+      "clientSecret",
+      "scopes",
+      // #1906 — shape only; the values are validated as absolute http(s) URLs
+      // where they're applied (core/auth/endpointOverrides.ts), so a typo drops
+      // one field with a warning instead of dropping the whole `oauth` block.
+      "authorizationUrl",
+      "tokenUrl"
+    ]) {
       if (o[k] !== void 0 && typeof o[k] !== "string") return false;
     }
+    if (o.authorizationParams !== void 0 && !isStringRecord(o.authorizationParams)) {
+      return false;
+    }
     if (o.enterpriseManaged !== void 0 && typeof o.enterpriseManaged !== "boolean") {
       return false;
     }
+    if (o.requestRefreshToken !== void 0 && typeof o.requestRefreshToken !== "boolean") {
+      return false;
+    }
     return true;
   };
   const isRootArray = (v) => {
@@ -2969,10 +4788,10 @@ function createRemoteApp(options) {
         );
         delete valObj.headers;
       }
-      if ("metadata" in valObj && !isKvArray(valObj.metadata)) {
+      if ("metadata" in valObj && !isJsonObject(valObj.metadata) && !isKvArray(valObj.metadata)) {
         logWarn(
           { route: "/api/servers", id, droppedKey: "metadata" },
-          "Dropping malformed `metadata` field \u2014 expected `Array<{ key: string, value: string }>`."
+          "Dropping malformed `metadata` field \u2014 expected a JSON object."
         );
         delete valObj.metadata;
       }
@@ -3007,7 +4826,7 @@ function createRemoteApp(options) {
       if ("oauth" in valObj && !isOauthObject(valObj.oauth)) {
         logWarn(
           { route: "/api/servers", id, droppedKey: "oauth" },
-          "Dropping malformed `oauth` field \u2014 expected `{ clientId?, clientSecret?, scopes?, enterpriseManaged? }`."
+          "Dropping malformed `oauth` field \u2014 expected `{ clientId?, clientSecret?, scopes?, authorizationParams?, authorizationUrl?, tokenUrl?, enterpriseManaged?, onInsufficientScope?, requestRefreshToken? }`."
         );
         delete valObj.oauth;
       }
@@ -3070,16 +4889,15 @@ function createRemoteApp(options) {
   const applyStdioSettingsToConfig = (entry, settings, provided) => {
     if (!(entry.type === "stdio" || entry.type === void 0)) return;
     const stdio = entry;
+    const { env, cwd } = stdioConfigFieldsFromSettings(settings);
     if (provided.env) {
-      const env = envPairsToRecord(settings.env);
-      if (Object.keys(env).length > 0) {
+      if (env) {
         stdio.env = env;
       } else {
         delete stdio.env;
       }
     }
     if (provided.cwd) {
-      const cwd = settings.cwd?.trim();
       if (cwd) {
         stdio.cwd = cwd;
       } else {
@@ -3110,10 +4928,10 @@ function createRemoteApp(options) {
         error: "settings.headers must be an array of { key, value }"
       };
     }
-    if (!isKvArray2(obj.metadata)) {
+    if (!isJsonObject(obj.metadata)) {
       return {
         ok: false,
-        error: "settings.metadata must be an array of { key, value }"
+        error: "settings.metadata must be a JSON object"
       };
     }
     if (obj.env !== void 0 && !isKvArray2(obj.env)) {
@@ -3164,18 +4982,34 @@ function createRemoteApp(options) {
     for (const optional of [
       "oauthClientId",
       "oauthClientSecret",
-      "oauthScopes"
+      "oauthScopes",
+      // #1906 — string-shaped on the wire; URL validity is checked where the
+      // override is applied, not here.
+      "oauthAuthorizationUrl",
+      "oauthTokenUrl"
     ]) {
       if (obj[optional] !== void 0 && typeof obj[optional] !== "string") {
         return { ok: false, error: `settings.${optional} must be a string` };
       }
     }
+    if (obj.oauthAuthorizationParams !== void 0 && !isKvArray2(obj.oauthAuthorizationParams)) {
+      return {
+        ok: false,
+        error: "settings.oauthAuthorizationParams must be an array of { key, value }"
+      };
+    }
     if (obj.enterpriseManaged !== void 0 && typeof obj.enterpriseManaged !== "boolean") {
       return {
         ok: false,
         error: "settings.enterpriseManaged must be a boolean"
       };
     }
+    if (obj.oauthRequestRefreshToken !== void 0 && typeof obj.oauthRequestRefreshToken !== "boolean") {
+      return {
+        ok: false,
+        error: "settings.oauthRequestRefreshToken must be a boolean"
+      };
+    }
     if (obj.oauthOnInsufficientScope !== void 0 && obj.oauthOnInsufficientScope !== "reauthorize" && obj.oauthOnInsufficientScope !== "throw") {
       return {
         ok: false,
@@ -3243,9 +5077,21 @@ function createRemoteApp(options) {
     if (typeof obj.oauthScopes === "string" && obj.oauthScopes !== "") {
       value.oauthScopes = obj.oauthScopes;
     }
+    if (isKvArray2(obj.oauthAuthorizationParams)) {
+      value.oauthAuthorizationParams = obj.oauthAuthorizationParams;
+    }
+    if (typeof obj.oauthAuthorizationUrl === "string" && obj.oauthAuthorizationUrl !== "") {
+      value.oauthAuthorizationUrl = obj.oauthAuthorizationUrl;
+    }
+    if (typeof obj.oauthTokenUrl === "string" && obj.oauthTokenUrl !== "") {
+      value.oauthTokenUrl = obj.oauthTokenUrl;
+    }
     if (obj.enterpriseManaged === true) {
       value.enterpriseManaged = true;
     }
+    if (obj.oauthRequestRefreshToken === false) {
+      value.oauthRequestRefreshToken = false;
+    }
     if (obj.oauthOnInsufficientScope === "reauthorize" || obj.oauthOnInsufficientScope === "throw") {
       value.oauthOnInsufficientScope = obj.oauthOnInsufficientScope;
     }
@@ -3290,23 +5136,13 @@ function createRemoteApp(options) {
     return { mcpServers: normalizeMcpServers(parsed?.mcpServers) };
   };
   const writeKeychainEntriesFor = async (id, secrets) => {
-    await Promise.all(
-      Object.entries(secrets).map(
-        ([field, value]) => secretStore.set(id, field, value)
-      )
-    );
+    await secretStoreSetMany(secretStore, id, secrets);
   };
   const readKeychainEntriesFor = async (id, fields) => {
-    const values = await Promise.all(
-      fields.map(
-        async (field) => [field, await secretStore.get(id, field)]
-      )
-    );
-    const out = {};
-    for (const [field, v] of values) {
-      if (v !== null) out[field] = v;
-    }
-    return out;
+    const many = await secretStoreGetMany(secretStore, [
+      { serverId: id, fields }
+    ]);
+    return many[id] ?? {};
   };
   const hasPlaintextSecrets = (config) => {
     for (const stored of Object.values(config.mcpServers)) {
@@ -3315,9 +5151,18 @@ function createRemoteApp(options) {
     }
     return false;
   };
+  let warnedSessionPreserved = false;
   const migratePlaintextSecrets = async (config) => {
     let changed = false;
     const next = { mcpServers: {} };
+    const durable = await secretStoreIsDurable(secretStore);
+    const warnSessionPreserved = () => {
+      if (warnedSessionPreserved || durable || !fileLogger) return;
+      warnedSessionPreserved = true;
+      fileLogger.warn(
+        "Secrets are kept in memory for this session, so plaintext values in mcp.json are left on disk rather than migrated away. They would otherwise be lost when the Inspector exits."
+      );
+    };
     try {
       for (const [id, stored] of Object.entries(config.mcpServers)) {
         const { stripped, secrets } = extractSecretsFromStored(stored);
@@ -3326,20 +5171,25 @@ function createRemoteApp(options) {
           continue;
         }
         for (const [field, value] of Object.entries(secrets)) {
-          const existing = await secretStore.get(id, field);
+          const existing = await secretStoreGetStrict(secretStore, id, field);
           if (existing === null) {
             await secretStore.set(id, field, value);
           }
         }
+        if (!durable) {
+          warnSessionPreserved();
+          next.mcpServers[id] = stored;
+          continue;
+        }
         next.mcpServers[id] = stripped;
         changed = true;
       }
     } catch (err) {
-      if (err instanceof KeychainUnavailableError) {
+      if (err instanceof SecretStoreUnavailableError) {
         if (fileLogger) {
           fileLogger.warn(
             { err: err.message },
-            "Keychain unavailable; skipping plaintext-secret migration on this read. Existing mcp.json plaintext values are preserved."
+            "Secret store unavailable; skipping plaintext-secret migration on this read. Existing mcp.json plaintext values are preserved."
           );
         }
         return { migrated: config, changed: false };
@@ -3349,22 +5199,20 @@ function createRemoteApp(options) {
     return { migrated: next, changed };
   };
   const rehydrateConfig = async (config) => {
+    const entries = Object.entries(config.mcpServers);
+    const secrets = await secretStoreGetMany(
+      secretStore,
+      entries.map(([serverId, stored]) => ({
+        serverId,
+        fields: expectedSecretFields(stored)
+      }))
+    );
     const out = { mcpServers: {} };
-    for (const [id, stored] of Object.entries(config.mcpServers)) {
-      const fields = expectedSecretFields(stored);
-      const secrets = await readKeychainEntriesFor(id, fields);
-      out.mcpServers[id] = mergeSecretsIntoStored(stored, secrets);
+    for (const [id, stored] of entries) {
+      out.mcpServers[id] = mergeSecretsIntoStored(stored, secrets[id] ?? {});
     }
     return out;
   };
-  const computeObsoleteFields = (previousFields, nextSecrets) => {
-    const nextFieldSet = new Set(Object.keys(nextSecrets));
-    const obsolete = [];
-    for (const field of previousFields) {
-      if (!nextFieldSet.has(field)) obsolete.push(field);
-    }
-    return obsolete;
-  };
   const mergeRenameKeychainSecrets = (stripped, keychainSecrets, nextSecrets) => {
     const allowedFields = new Set(expectedSecretFields(stripped));
     const merged = { ...keychainSecrets, ...nextSecrets };
@@ -3377,8 +5225,18 @@ function createRemoteApp(options) {
   const deleteKeychainFields = async (id, fields) => {
     await Promise.all(fields.map((field) => secretStore.delete(id, field)));
   };
+  const entryForDisk = async (built, stripped, previous) => {
+    if (await secretStoreIsDurable(secretStore)) return stripped;
+    const prior = previous ? extractSecretsFromStored(previous).secrets : {};
+    const submitted = extractSecretsFromStored(built).secrets;
+    const carry = {};
+    for (const [field, value] of Object.entries(submitted)) {
+      if (prior[field] === value) carry[field] = value;
+    }
+    return Object.keys(carry).length > 0 ? mergeSecretsIntoStored(stripped, carry) : stripped;
+  };
   const keychainErrorResponse = (c, err) => {
-    if (err instanceof KeychainUnavailableError) {
+    if (err instanceof SecretStoreUnavailableError) {
       return c.json({ error: err.message }, 503);
     }
     return void 0;
@@ -3441,7 +5299,7 @@ function createRemoteApp(options) {
       type,
       process.platform,
       homedir(),
-      (path3) => existsSync2(path3) ? readFileSync4(path3, "utf-8") : null
+      (path6) => existsSync3(path6) ? readFileSync5(path6, "utf-8") : null
     );
     if (!result) {
       return c.json(
@@ -3488,7 +5346,7 @@ function createRemoteApp(options) {
         const { stripped, secrets } = extractSecretsFromStored(built);
         await secretStore.deleteAllForServer(id);
         await writeKeychainEntriesFor(id, secrets);
-        current.mcpServers[id] = stripped;
+        current.mcpServers[id] = await entryForDisk(built, stripped);
         await writeMcpAndTrackMtime(serializeStore(current));
         return c.json({ ok: true });
       });
@@ -3628,10 +5486,11 @@ function createRemoteApp(options) {
           }
         }
         const { stripped, secrets } = extractSecretsFromStored(built);
+        const onDisk = await entryForDisk(built, stripped, existing);
         const next = { mcpServers: {} };
         for (const [key, val] of Object.entries(current.mcpServers)) {
           if (key === originalId) {
-            next.mcpServers[newId] = stripped;
+            next.mcpServers[newId] = onDisk;
           } else {
             next.mcpServers[key] = val;
           }
@@ -3652,7 +5511,10 @@ function createRemoteApp(options) {
           await secretStore.deleteAllForServer(originalId);
         } else {
           const previousFields = new Set(expectedSecretFields(existing));
-          const obsolete = computeObsoleteFields(previousFields, secrets);
+          const stillExpected = new Set(expectedSecretFields(built));
+          const obsolete = [...previousFields].filter(
+            (field) => field === SECRET_FIELD_OAUTH_CLIENT_SECRET ? settingsIntent.kind !== "preserve" && !(field in secrets) : !stillExpected.has(field)
+          );
           await writeKeychainEntriesFor(newId, secrets);
           await writeMcpAndTrackMtime(serializeStore(next));
           await deleteKeychainFields(newId, obsolete);
@@ -3701,14 +5563,9 @@ function createRemoteApp(options) {
         serverEventSubscribers.add(send);
         ensureWatcher();
       }
-      await stream.write(SSE_PRIMING_COMMENT);
-      stream.onAbort(() => {
+      await primeAndHoldSseStream(stream, () => {
         serverEventSubscribers.delete(send);
         void maybeStopWatcher();
-        stream.close();
-      });
-      await new Promise((resolve6) => {
-        stream.onAbort(() => resolve6());
       });
     });
   });
@@ -3773,6 +5630,16 @@ function honoMiddlewarePlugin(config) {
         allowedOrigins: config.allowedOrigins
       });
       await sandboxController.start();
+      const appOriginController = createAppOriginController({
+        port: config.appOriginPort,
+        host: config.sandboxHost,
+        embedderOrigins: appDocumentEmbedders(
+          sandboxController.getUrl(),
+          config.allowedOrigins
+        )
+      });
+      await appOriginController.start();
+      const secretStorage = await getSecretStorageInfo();
       const {
         app: honoApp,
         authToken: resolvedToken,
@@ -3786,14 +5653,21 @@ function honoMiddlewarePlugin(config) {
         initialServers: config.initialServers ?? void 0,
         allowedOrigins: config.allowedOrigins,
         sandboxUrl: sandboxController.getUrl() ?? void 0,
+        publishAppDocument: (doc) => appOriginController.publish(doc),
         logger: config.logger,
-        initialConfig: webServerConfigToInitialPayload(config)
+        initialConfig: webServerConfigToInitialPayload(config, secretStorage),
+        // The startup value above is what the banner printed; the route
+        // re-resolves per request, because the first write under a newly-set
+        // passphrase encrypts a pre-existing plaintext file and a captured
+        // descriptor would keep reporting the old state until a restart.
+        secretStorageResolver: getSecretStorageInfo
       });
       resolvedAuthToken = config.dangerouslyOmitAuth ? "" : resolvedToken;
       const originalClose = server.close.bind(server);
       server.close = async () => {
         await closeApi();
         await sandboxController.close();
+        await appOriginController.close();
         return originalClose();
       };
       const sandboxUrl = sandboxController.getUrl();
@@ -3804,10 +5678,11 @@ function honoMiddlewarePlugin(config) {
           config,
           actualPort,
           resolvedToken,
-          sandboxUrl ?? void 0
+          sandboxUrl ?? void 0,
+          secretStorage
         );
         if (config.autoOpen) {
-          open(url);
+          openBrowser(url);
         }
       };
       server.httpServer.once("listening", () => {
@@ -3842,10 +5717,10 @@ function honoMiddlewarePlugin(config) {
           if (req.method !== "GET" && req.method !== "HEAD") {
             const chunks = [];
             req.on("data", (chunk) => chunks.push(chunk));
-            await new Promise((resolve6) => {
-              req.once("end", () => resolve6());
-              req.once("error", () => resolve6());
-              req.once("close", () => resolve6());
+            await new Promise((resolve9) => {
+              req.once("end", () => resolve9());
+              req.once("error", () => resolve9());
+              req.once("close", () => resolve9());
             });
             if (chunks.length > 0) {
               init.body = Buffer.concat(chunks);
@@ -3887,10 +5762,10 @@ function honoMiddlewarePlugin(config) {
                 while (true) {
                   const { done, value } = await reader.read();
                   if (done || clientGone || res.destroyed) break;
-                  await new Promise((resolve6, reject) => {
+                  await new Promise((resolve9, reject) => {
                     res.write(
                       Buffer.from(value),
-                      (err) => err ? reject(err) : resolve6()
+                      (err) => err ? reject(err) : resolve9()
                     );
                   });
                 }
@@ -3924,7 +5799,7 @@ function honoMiddlewarePlugin(config) {
 
 // server/vite-base-config.ts
 import { rmSync } from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 var NODE_ONLY_OPTIMIZE_DEPS_EXCLUDE = [
   "@modelcontextprotocol/client/stdio",
   // `atomically` is reached only through `core/storage/store-io.ts`,
@@ -3947,7 +5822,15 @@ var NODE_ONLY_OPTIMIZE_DEPS_EXCLUDE = [
   // (#1905). It's a native-binding package (no browser code path) so
   // excluding it keeps Vite's dep scanner from chasing into the
   // platform-specific binaries during dev startup.
-  "@napi-rs/keyring"
+  "@napi-rs/keyring",
+  // `proper-lockfile` is reached only through `core/auth/node/file-lock.ts`
+  // — the secrets file's cross-process lock (#2082) — which the Hono
+  // `/api/servers` handlers pull in via `core/auth/node/file-secret-store.ts`.
+  // Same node-only import chain as `atomically` above, and the same reason:
+  // it is CJS with a `graceful-fs`/`signal-exit`/`retry` graph that Vite's
+  // dev scanner has no business walking. Note the tsup `external` lists do
+  // **not** cover this — they configure the production bundles, not `vite dev`.
+  "proper-lockfile"
 ];
 function getViteDevOptimizeDeps() {
   return {
@@ -3958,21 +5841,21 @@ function getViteDevOptimizeDeps() {
   };
 }
 function clearViteDepsCache(clientWebRoot) {
-  rmSync(join5(clientWebRoot, "node_modules", ".vite"), {
+  rmSync(join6(clientWebRoot, "node_modules", ".vite"), {
     recursive: true,
     force: true
   });
 }
 
 // ../../vitest.shared.mts
-import path2 from "path";
+import path5 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function vitestSharedPaths(clientDir) {
-  const dirname8 = path2.resolve(clientDir);
-  const repoRoot = path2.resolve(dirname8, "../..");
+  const dirname10 = path5.resolve(clientDir);
+  const repoRoot = path5.resolve(dirname10, "../..");
   const sharedAliases = {
-    "@inspector/core": path2.resolve(repoRoot, "core"),
-    "@modelcontextprotocol/inspector-test-server": path2.resolve(
+    "@inspector/core": path5.resolve(repoRoot, "core"),
+    "@modelcontextprotocol/inspector-test-server": path5.resolve(
       repoRoot,
       "test-servers/build/index.js"
     )
@@ -3986,58 +5869,58 @@ function vitestSharedPaths(clientDir) {
   const nodeModulesAliases = [
     {
       find: /^react$/,
-      replacement: path2.resolve(dirname8, "node_modules/react")
+      replacement: path5.resolve(dirname10, "node_modules/react")
     },
     {
       find: /^react\/jsx-runtime$/,
-      replacement: path2.resolve(dirname8, "node_modules/react/jsx-runtime.js")
+      replacement: path5.resolve(dirname10, "node_modules/react/jsx-runtime.js")
     },
     {
       find: /^react\/jsx-dev-runtime$/,
-      replacement: path2.resolve(
-        dirname8,
+      replacement: path5.resolve(
+        dirname10,
         "node_modules/react/jsx-dev-runtime.js"
       )
     },
     {
       find: /^react-dom$/,
-      replacement: path2.resolve(dirname8, "node_modules/react-dom")
+      replacement: path5.resolve(dirname10, "node_modules/react-dom")
     },
     {
       find: /^react-dom\/client$/,
-      replacement: path2.resolve(dirname8, "node_modules/react-dom/client.js")
+      replacement: path5.resolve(dirname10, "node_modules/react-dom/client.js")
     },
-    { find: /^pino$/, replacement: path2.resolve(dirname8, "node_modules/pino") },
+    { find: /^pino$/, replacement: path5.resolve(dirname10, "node_modules/pino") },
     {
       find: /^pino\/browser\.js$/,
-      replacement: path2.resolve(dirname8, "node_modules/pino/browser.js")
+      replacement: path5.resolve(dirname10, "node_modules/pino/browser.js")
     },
     {
       find: /^hono$/,
-      replacement: path2.resolve(dirname8, "node_modules/hono/dist/index.js")
+      replacement: path5.resolve(dirname10, "node_modules/hono/dist/index.js")
     },
     {
       find: /^hono\/streaming$/,
-      replacement: path2.resolve(
-        dirname8,
+      replacement: path5.resolve(
+        dirname10,
         "node_modules/hono/dist/helper/streaming/index.js"
       )
     },
     {
       find: /^@hono\/node-server$/,
-      replacement: path2.resolve(dirname8, "node_modules/@hono/node-server")
+      replacement: path5.resolve(dirname10, "node_modules/@hono/node-server")
     },
     {
       find: /^atomically$/,
-      replacement: path2.resolve(dirname8, "node_modules/atomically")
+      replacement: path5.resolve(dirname10, "node_modules/atomically")
     },
     {
       find: /^chokidar$/,
-      replacement: path2.resolve(dirname8, "node_modules/chokidar")
+      replacement: path5.resolve(dirname10, "node_modules/chokidar")
     },
     {
       find: /^@napi-rs\/keyring$/,
-      replacement: path2.resolve(dirname8, "node_modules/@napi-rs/keyring")
+      replacement: path5.resolve(dirname10, "node_modules/@napi-rs/keyring")
     },
     // `express` and `yaml` resolve from the **repo root**, unlike every pin
     // above. Both are reached only through `test-servers/src` — express by the
@@ -4052,11 +5935,22 @@ function vitestSharedPaths(clientDir) {
     // failed to resolve it.
     {
       find: /^express$/,
-      replacement: path2.resolve(repoRoot, "node_modules/express")
+      replacement: path5.resolve(repoRoot, "node_modules/express")
     },
     {
       find: /^yaml$/,
-      replacement: path2.resolve(repoRoot, "node_modules/yaml")
+      replacement: path5.resolve(repoRoot, "node_modules/yaml")
+    },
+    // Same reasoning, one layer in: `proper-lockfile` is reached only through
+    // `core/` (the secrets file's cross-process lock, #2082), which is the
+    // other root-owned tree with no manifest of its own. Resolution finds the
+    // root copy on its own today — nothing declares it in a client — and this
+    // pin is what keeps that from depending on nothing ever arriving as some
+    // client's transitive dependency, which would otherwise give a test two
+    // copies of a module whose whole job is a single registry of held locks.
+    {
+      find: /^proper-lockfile$/,
+      replacement: path5.resolve(repoRoot, "node_modules/proper-lockfile")
     }
   ];
   const projectResolve = {
@@ -4079,9 +5973,9 @@ function vitestSharedPaths(clientDir) {
 }
 
 // server/start-vite-dev-server.ts
-var __dirname2 = dirname5(fileURLToPath4(import.meta.url));
+var __dirname2 = dirname7(fileURLToPath4(import.meta.url));
 async function startViteDevServer(config) {
-  const root = resolve3(join6(__dirname2, ".."));
+  const root = resolve6(join7(__dirname2, ".."));
   clearViteDepsCache(root);
   const { repoRoot, sharedAliases, sharedDedupe, nodeModulesAliases } = vitestSharedPaths(root);
   const inlineConfig = {
@@ -4115,7 +6009,7 @@ async function startViteDevServer(config) {
     },
     plugins: [react(), honoMiddlewarePlugin(config)]
   };
-  const server = await createServer2(inlineConfig);
+  const server = await createServer3(inlineConfig);
   await server.listen();
   return {
     async close() {
@@ -4125,16 +6019,15 @@ async function startViteDevServer(config) {
 }
 
 // server/server.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { join as join7, dirname as dirname6 } from "path";
+import { readFileSync as readFileSync6 } from "fs";
+import { join as join8, dirname as dirname8 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
-import { randomBytes as randomBytes2 } from "crypto";
-import open2 from "open";
+import { randomBytes as randomBytes4 } from "crypto";
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono as Hono2 } from "hono";
 var __filename = fileURLToPath5(import.meta.url);
-var __dirname3 = dirname6(__filename);
+var __dirname3 = dirname8(__filename);
 async function startHonoServer(config) {
   const sandboxController = createSandboxController({
     port: config.sandboxPort,
@@ -4142,8 +6035,18 @@ async function startHonoServer(config) {
     allowedOrigins: config.allowedOrigins
   });
   await sandboxController.start();
-  const resolvedAuthToken = config.authToken || (config.dangerouslyOmitAuth ? "" : randomBytes2(32).toString("hex"));
+  const appOriginController = createAppOriginController({
+    port: config.appOriginPort,
+    host: config.sandboxHost,
+    embedderOrigins: appDocumentEmbedders(
+      sandboxController.getUrl(),
+      config.allowedOrigins
+    )
+  });
+  await appOriginController.start();
+  const resolvedAuthToken = config.authToken || (config.dangerouslyOmitAuth ? "" : randomBytes4(32).toString("hex"));
   const rootPath = config.staticRoot ?? __dirname3;
+  const secretStorage = await getSecretStorageInfo();
   const { app: apiApp, close: closeApi } = createRemoteApp({
     authToken: config.dangerouslyOmitAuth ? void 0 : resolvedAuthToken,
     dangerouslyOmitAuth: config.dangerouslyOmitAuth,
@@ -4153,16 +6056,22 @@ async function startHonoServer(config) {
     initialServers: config.initialServers ?? void 0,
     allowedOrigins: config.allowedOrigins,
     sandboxUrl: sandboxController.getUrl() ?? void 0,
+    publishAppDocument: (doc) => appOriginController.publish(doc),
     logger: config.logger,
-    initialConfig: webServerConfigToInitialPayload(config)
+    initialConfig: webServerConfigToInitialPayload(config, secretStorage),
+    // The startup value above is what the banner printed; the route
+    // re-resolves per request, because the first write under a newly-set
+    // passphrase encrypts a pre-existing plaintext file and a captured
+    // descriptor would keep reporting the old state until a restart.
+    secretStorageResolver: getSecretStorageInfo
   });
   const app = new Hono2();
   app.use("/api/*", async (c) => {
     return apiApp.fetch(c.req.raw);
   });
   const serveIndexHtml = (c) => {
-    const indexPath = join7(rootPath, "index.html");
-    const html = readFileSync5(indexPath, "utf-8");
+    const indexPath = join8(rootPath, "index.html");
+    const html = readFileSync6(indexPath, "utf-8");
     c.header("Cache-Control", "no-store");
     return c.html(injectAuthToken(html, resolvedAuthToken));
   };
@@ -4198,10 +6107,11 @@ async function startHonoServer(config) {
         config,
         info.port,
         resolvedAuthToken,
-        sandboxUrl ?? void 0
+        sandboxUrl ?? void 0,
+        secretStorage
       );
       if (config.autoOpen) {
-        open2(url);
+        openBrowser(url);
       }
     }
   );
@@ -4219,19 +6129,20 @@ async function startHonoServer(config) {
     async close() {
       await closeApi();
       await sandboxController.close();
+      await appOriginController.close();
       if ("closeAllConnections" in httpServer) {
         httpServer.closeAllConnections();
       }
-      await new Promise((resolve6, reject) => {
-        httpServer.close((err) => err ? reject(err) : resolve6());
+      await new Promise((resolve9, reject) => {
+        httpServer.close((err) => err ? reject(err) : resolve9());
       });
     }
   };
 }
 
 // server/ensure-web-build.ts
-import { existsSync as existsSync3 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { join as join9 } from "path";
 import { spawnSync } from "child_process";
 function runViteBuild(webRoot, log) {
   const result = spawnSync("npm", ["run", "build:client"], {
@@ -4246,10 +6157,10 @@ function runViteBuild(webRoot, log) {
   return result.status;
 }
 function ensureWebBuild(webRoot, distRoot, deps = {}) {
-  const exists = deps.exists ?? existsSync3;
+  const exists = deps.exists ?? existsSync4;
   const build = deps.build ?? runViteBuild;
   const log = deps.log ?? ((message) => console.log(message));
-  const indexHtml = join8(distRoot, "index.html");
+  const indexHtml = join9(distRoot, "index.html");
   if (exists(indexHtml)) return;
   log(
     "No production web build found at clients/web/dist. Building the web UI now (first run only; this can take a minute)..."
@@ -4263,10 +6174,10 @@ function ensureWebBuild(webRoot, distRoot, deps = {}) {
 }
 
 // server/run-web.ts
-var __dirname4 = dirname7(fileURLToPath6(import.meta.url));
+var __dirname4 = dirname9(fileURLToPath6(import.meta.url));
 function ensureStdioCwd(config) {
   if ((config.type === "stdio" || config.type === void 0) && config.command && !config.cwd) {
-    return { ...config, cwd: resolve4(process.cwd()) };
+    return { ...config, cwd: resolve7(process.cwd()) };
   }
   return config;
 }
@@ -4324,7 +6235,7 @@ async function runWeb(argv) {
         "Note: --server has no effect on the web UI yet; it lists every server in the catalog."
       );
     }
-    mcpConfigPath = resolve4(process.cwd(), catalogPath);
+    mcpConfigPath = resolve7(process.cwd(), catalogPath);
     writable = true;
   } else if (hasConfig) {
     if (opts.server) {
@@ -4332,7 +6243,7 @@ async function runWeb(argv) {
         "Note: --server has no effect on the web UI yet; it lists every server in the file."
       );
     }
-    const resolvedConfigPath = resolve4(process.cwd(), opts.config);
+    const resolvedConfigPath = resolve7(process.cwd(), opts.config);
     try {
       resolveServerConfigs({ configPath: resolvedConfigPath }, "multi");
     } catch (err) {
@@ -4353,14 +6264,14 @@ async function runWeb(argv) {
         cwd: opts.cwd,
         env: opts.e
       };
-      const resolved = resolveServerConfigs(serverOptions, "single")[0];
-      if (!resolved) {
+      const resolved2 = resolveServerConfigs(serverOptions, "single")[0];
+      if (!resolved2) {
         console.error(
           "Error: Could not resolve server config. Pass a command/URL, or use --catalog / --config to serve a file."
         );
         process.exit(1);
       }
-      config = ensureStdioCwd(resolved);
+      config = ensureStdioCwd(resolved2);
     } catch (err) {
       const message = err instanceof Error ? err.message : "Could not resolve server config.";
       console.error("Error:", message);
@@ -4400,8 +6311,8 @@ async function runWeb(argv) {
     console.error("Error:", message);
     process.exit(1);
   }
-  const webRoot = join9(__dirname4, "..");
-  const distRoot = join9(webRoot, "dist");
+  const webRoot = join10(__dirname4, "..");
+  const distRoot = join10(webRoot, "dist");
   if (!isDev) {
     webConfig.staticRoot = distRoot;
   }
@@ -4432,7 +6343,7 @@ async function runWeb(argv) {
 
 // src/index.ts
 var __filename2 = fileURLToPath7(import.meta.url);
-var isMain = process.argv[1] !== void 0 && resolve5(process.argv[1]) === resolve5(__filename2);
+var isMain = process.argv[1] !== void 0 && resolve8(process.argv[1]) === resolve8(__filename2);
 if (isMain) {
   runWeb(process.argv).then((code) => process.exit(code ?? 0)).catch((e) => {
     console.error(e);
@@ -4442,3 +6353,16 @@ if (isMain) {
 export {
   runWeb
 };
+/* v8 ignore next 2 -- @preserve: the non-Error arm is unreachable via
+   proper-lockfile, which rejects only with Errors. */
+/* v8 ignore next -- @preserve: node validates the cost parameters
+   synchronously (an out-of-grammar `N` throws from the call itself,
+   which the corrupt-KDF test exercises), so this asynchronous channel
+   is left for allocation failure — not provokable deterministically. */
+/* v8 ignore next -- @preserve: unreachable, `encryptedEnvelopeProblem`
+   above returns a reason for anything `decodeParts` would reject. Kept as
+   the type narrowing `parts` needs. */
+/* v8 ignore next -- @preserve: the walk can only run out of ancestors if
+   the filesystem root itself does not exist, which would mean the process
+   has no cwd to have resolved against. Kept as the loop's termination
+   guard rather than trusting that invariant. */